CVE-2023-4863: high-severity vulnerability in Google libwebp
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in the libwebp image library allowed attackers to crash your browser or potentially run malicious code by sending you a specially crafted webpage containing a problematic image. This happens because the library doesn't properly check memory boundaries when processing certain image data.
Heap buffer overflow in libwebp's image processing pipeline permits an unauthenticated remote attacker to write beyond allocated memory bounds via crafted WebP image content embedded in HTML. Exploitation requires only user interaction (visiting a malicious webpage); successful exploitation can lead to arbitrary code execution with browser privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.