Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2023-4863

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

VectorNETWORK

PublishedSep 12, 2023, 15:15

Published Bychrome-cve-admin@google.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

libwebp-sys2(crates.io)00.1.8N/A

libwebp-sys(crates.io)00.9.3N/A

electron(npm)22.0.022.3.24N/A

electron(npm)24.0.024.8.3N/A

electron(npm)25.0.025.8.1N/A

electron(npm)26.0.026.2.1N/A

electron(npm)27.0.0-beta.127.0.0-beta.2N/A

SkiaSharp(NuGet)2.0.02.88.6N/A

github.com/chai2010/webp(Go)1.1.21.4.0N/A

Pillow(PyPI)010.0.1N/A

webp(crates.io)00.2.6N/A

magick.net-q16-anycpu(NuGet)013.3.0N/A

magick.net-q16-hdri-anycpu(NuGet)013.3.0N/A

magick.net-q16-x64(NuGet)013.3.0N/A

magick.net-q8-anycpu(NuGet)013.3.0N/A

magick.net-q8-openmp-x64(NuGet)013.3.0N/A

magick.net-q8-x64(NuGet)013.3.0N/A

github.com/chai2010/webp(Go)00.0.0-20250406010349-76805d5a8860N/A

github.com/chai2010/webp(Go)0.0.01.1.2-0.20250406010349-76805d5a8860N/A

References

Weakness Type

CWE-787

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK