NetSight
IP …
high8.8Known exploited

CVE-2023-4863

libwebp: OOB write in BuildHuffmanTable

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-09-13. Federal due date: 2023-10-04.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Affected packages

EcosystemPackageAffectedFixed in
rustlibwebp-sys2< 0.1.80.1.8
rustlibwebp-sys< 0.9.30.9.3
npmelectron>= 22.0.0, < 22.3.2422.3.24
nugetSkiaSharp>= 2.0.0, < 2.88.62.88.6
pipPillow< 10.0.110.0.1
rustwebp< 0.2.60.2.6
nugetmagick.net-q16-anycpu< 13.3.013.3.0
nugetmagick.net-q16-hdri-anycpu< 13.3.013.3.0
nugetmagick.net-q16-x64< 13.3.013.3.0
nugetmagick.net-q8-anycpu< 13.3.013.3.0
nugetmagick.net-q8-openmp-x64< 13.3.013.3.0
nugetmagick.net-q8-x64< 13.3.013.3.0
gogithub.com/chai2010/webp< 0.0.0-20250406010349-76805d5a88600.0.0-20250406010349-76805d5a8860

Affected products

VendorProductAffected versions
GoogleChrome
before 116.0.5845.187
FedoraprojectFedora
Versions 37, 38, 39
DebianDebian Linux
Versions 10.0, 11.0, 12.0
MozillaFirefox
before 102.15.1
before 117.0.1
from 115.1.0 before 115.2.1
MozillaThunderbird
before 102.15.1
from 115.0 before 115.2.2
MicrosoftEdge Chromium
before 116.0.1938.81
MicrosoftTeams
before 1.6.00.26463
before 1.6.00.26474
MicrosoftWebp Image Extension
before 1.0.62681.0
WebmprojectLibwebp
before 1.3.2
NetappActive Iq Unified Manager
All versions
BentleySeequent Leapfrog
before 2023.2
BandisoftHoneyview
before 5.51

Weakness classification

CWE-787

References