ClosedHighPatched

libwebp heap overflow exploited in the wild (CVE-2023-4863)

libwebp (Google Chrome and everything that bundles libwebp)

A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.

Why this severity: CVSS 8.8 (NVD), Chromium severity Critical, actively exploited (CISA KEV)

Started: Sep 11, 2023
Closed: Sep 13, 2023
CVE: CVE-2023-4863

Follow this incident

Updated Sep 13, 2023

Affected

Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)

Fixed in

Chrome 116.0.5845.187
libwebp 1.3.2
Bundling apps/libraries: see each vendor's advisory

Timeline2

Sep 13, 2023
CISA adds CVE-2023-4863 to the KEV catalog
Sep 11, 2023
Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild
Source

Advisories3

Notes & caveats

Related to Apple's BLASTPASS fixes (apple-blastpass-cve-2023-41064-41061). Node (sharp, Electron) and Python (Pillow wheels) packages that bundle libwebp shipped updated builds.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified