Skip to content

CVE-2023-4863 — Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp…

Key facts

CVE-2023-4863 is a High (8.8) vulnerability: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp…. This entry ships a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-09-13), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2023-4863 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-09-13), confirming exploitation in the wild. Federal remediation deadline: 2023-10-04. Prioritise patching and deploy the detection and prevention rules below.
CVE CVE-2023-4863
Severity High (8.8)
CISA KEV Actively exploited (added 2023-09-13)
Detection / prevention —
PoC poc.py
Source 2023/CVE-2023-4863/

Details

English | 한국어

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Vulnerability Details

Property Value
CVE ID CVE-2023-4863
Type RCE
CVSS Score 8.8

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2023/CVE-2023-4863/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2023-4863

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application URL Status
Vulnerable App http://localhost:8080 Shows vulnerability
Patched App http://localhost:8081 Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

  • http://www.openwall.com/lists/oss-security/2023/09/21/4
  • http://www.openwall.com/lists/oss-security/2023/09/22/1
  • http://www.openwall.com/lists/oss-security/2023/09/22/3
  • http://www.openwall.com/lists/oss-security/2023/09/22/4
  • http://www.openwall.com/lists/oss-security/2023/09/22/5
  • http://www.openwall.com/lists/oss-security/2023/09/22/6
  • http://www.openwall.com/lists/oss-security/2023/09/22/7
  • http://www.openwall.com/lists/oss-security/2023/09/22/8
  • http://www.openwall.com/lists/oss-security/2023/09/26/1
  • http://www.openwall.com/lists/oss-security/2023/09/26/7
  • http://www.openwall.com/lists/oss-security/2023/09/28/1
  • http://www.openwall.com/lists/oss-security/2023/09/28/2
  • http://www.openwall.com/lists/oss-security/2023/09/28/4
  • https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
  • https://blog.isosceles.com/the-webp-0day/
  • https://bugzilla.suse.com/show_bug.cgi?id=1215231
  • https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
  • https://crbug.com/1479274
  • https://en.bandisoft.com/honeyview/history/
  • https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
  • https://github.com/webmproject/libwebp/releases/tag/v1.3.2
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
  • https://news.ycombinator.com/item?id=37478403
  • https://security-tracker.debian.org/tracker/CVE-2023-4863
  • https://security.gentoo.org/glsa/202309-05
  • https://security.gentoo.org/glsa/202401-10
  • https://security.netapp.com/advisory/ntap-20230929-0011/
  • https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
  • https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
  • https://www.bentley.com/advisories/be-2023-0001/
  • https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
  • https://www.debian.org/security/2023/dsa-5496
  • https://www.debian.org/security/2023/dsa-5497
  • https://www.debian.org/security/2023/dsa-5498
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
  • http://www.openwall.com/lists/oss-security/2023/09/21/4
  • http://www.openwall.com/lists/oss-security/2023/09/22/1
  • http://www.openwall.com/lists/oss-security/2023/09/22/3
  • http://www.openwall.com/lists/oss-security/2023/09/22/4
  • http://www.openwall.com/lists/oss-security/2023/09/22/5
  • http://www.openwall.com/lists/oss-security/2023/09/22/6
  • http://www.openwall.com/lists/oss-security/2023/09/22/7
  • http://www.openwall.com/lists/oss-security/2023/09/22/8
  • http://www.openwall.com/lists/oss-security/2023/09/26/1
  • http://www.openwall.com/lists/oss-security/2023/09/26/7
  • http://www.openwall.com/lists/oss-security/2023/09/28/1
  • http://www.openwall.com/lists/oss-security/2023/09/28/2
  • http://www.openwall.com/lists/oss-security/2023/09/28/4
  • https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
  • https://blog.isosceles.com/the-webp-0day/
  • https://bugzilla.suse.com/show_bug.cgi?id=1215231
  • https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
  • https://crbug.com/1479274
  • https://en.bandisoft.com/honeyview/history/
  • https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
  • https://github.com/webmproject/libwebp/releases/tag/v1.3.2
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
  • https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
  • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
  • https://news.ycombinator.com/item?id=37478403
  • https://security-tracker.debian.org/tracker/CVE-2023-4863
  • https://security.gentoo.org/glsa/202309-05
  • https://security.gentoo.org/glsa/202401-10
  • https://security.netapp.com/advisory/ntap-20230929-0011/
  • https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
  • https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
  • https://www.bentley.com/advisories/be-2023-0001/
  • https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
  • https://www.debian.org/security/2023/dsa-5496
  • https://www.debian.org/security/2023/dsa-5497
  • https://www.debian.org/security/2023/dsa-5498
  • https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
  • https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863

Generated by PoC Generator on 2026-07-09T06:50:49.814089439

Frequently asked questions

What is CVE-2023-4863?

CVE-2023-4863 is a High (8.8) vulnerability: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp…. This entry ships a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-09-13), confirming active exploitation in the wild.

How do I detect CVE-2023-4863?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2023-4863?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Is CVE-2023-4863 actively exploited?

Yes. CVE-2023-4863 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2023-09-13, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2023-10-04. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.