cyfenced.com →

[ CVE-2023-4863 · Published 12 Sep 2023 ]

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-09-13
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CISA: Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 4 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References