# libwebp heap overflow exploited in the wild (CVE-2023-4863) · pwn.watch

> A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.

Page: https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: high · status: closed · patch: patched
- Product: libwebp (Google Chrome and everything that bundles libwebp)
- Started: 2023-09-11 · closed: 2023-09-13
- CVEs: CVE-2023-4863
- Affected: Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)
- Fixed in: Chrome 116.0.5845.187; libwebp 1.3.2; Bundling apps/libraries: see each vendor's advisory

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863/feed.xml
- JSON Feed: https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json
- This file: https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863/llms.txt

## Updates (newest first)
- 2023-09-13: CISA adds CVE-2023-4863 to the KEV catalog
- 2023-09-11: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild (https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)

## Fix brief
# Security brief: libwebp heap overflow exploited in the wild (CVE-2023-4863)

Source: https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 · status: closed (closed Sep 13, 2023) · severity: high · updated Sep 13, 2023

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.

Severity detail: CVSS 8.8 (NVD), Chromium severity Critical, actively exploited (CISA KEV)

- Product: libwebp (Google Chrome and everything that bundles libwebp)
- CVE / advisory ids: CVE-2023-4863

## Affected versions
- Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Chrome 116.0.5845.187
- libwebp 1.3.2
- Bundling apps/libraries: see each vendor's advisory

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Sep 13, 2023: CISA adds CVE-2023-4863 to the KEV catalog
- Sep 11, 2023: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild

## Advisories
- [Stable Channel Update for Desktop (Sept 11, 2023)](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) (Google Chrome)
- [NVD: CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Caveats
Related to Apple's BLASTPASS fixes (apple-blastpass-cve-2023-41064-41061). Node (sharp, Electron) and Python (Pillow wheels) packages that bundle libwebp shipped updated builds.

---
Machine-readable: https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.