{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "libwebp",
    "label": "libwebp",
    "isStack": false,
    "url": "https://pwn.watch/t/libwebp",
    "feed": "https://pwn.watch/t/libwebp/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "libwebp-heap-overflow-cve-2023-4863",
      "title": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863",
      "json": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "libwebp (Google Chrome and everything that bundles libwebp)",
      "tags": [
        "node",
        "python",
        "libwebp",
        "google",
        "chrome",
        "electron",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-4863"
      ],
      "affectedVersions": [
        "Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)"
      ],
      "fixedVersions": [
        "Chrome 116.0.5845.187",
        "libwebp 1.3.2",
        "Bundling apps/libraries: see each vendor's advisory"
      ],
      "startedAt": "2023-09-11",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "libwebp-heap-overflow-cve-2023-4863",
      "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-13",
      "title": "CISA adds CVE-2023-4863 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863"
    },
    {
      "incident": "libwebp-heap-overflow-cve-2023-4863",
      "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-11",
      "title": "Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild",
      "body": null,
      "sourceUrl": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html",
      "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863"
    }
  ]
}