CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 117
⚡ KEV — Known Exploited
CVSS 9.8 (Critical)
EPSS 0.9521 (1th pct)
Technical Description
Heap buffer overflow in libwebp in Google Chrome prior to 117.0.5938.62 and libwebp 1.3.2 allowed remote attackers to execute arbitrary code.
Why this matters to your organisation:
The organisation uses libwebp, which is affected by CVE-2023-4863. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 95.2% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
The organisation uses libwebp, which is affected by CVE-2023-4863. CISA has confirmed active exploitation in the wild (KEV catalogue entry). The Exploit Prediction Scoring System (EPSS) estimates a 95.2% probability of exploitation within 30 days. The affected service is internet-facing, increasing exposure. This is a critical service for the organisation.
Potential Impact
A vulnerability in libwebp rated Critical (CVSS 9.8). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalogue, indicating it has been actively exploited in the wild.
✅ Recommended Next Action
Review the vendor advisory for CVE-2023-4863 and assess whether patching or compensating controls are appropriate for your environment. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-4863
Confidence: High
The installed version exactly matches an affected version.
CVE Details
| Product | libwebp libwebp |
| Version Range | < 1.3.2 → ∞ |
| Installed | 1.3.1 |
| Match Type | Exact Match |
| CVSS | 9.8 |
| KEV | YES |
| EPSS | 0.9521 |
| Source |
NVD · Sept. 15, 2023 View reference ↗ |
Score Breakdown
⚡ KEV+40
🌐 Exposure+20
⭐ Importance+15
📈 EPSS+14.3
🔢 CVSS+9.8
Total99