Vulnerabilities

CVE-2023-4863: A Comprehensive Guide

3 min read

ResilientX

CVE-2023-4863 is a significant vulnerability discovered in 2023, has been making headlines and raising concerns across the tech community.

What is CVE-2023-4863?

CVE-2023-4863 refers to a critical heap buffer overflow vulnerability found in the libwebp package, widely used for encoding and decoding WebP images. This vulnerability enables a program to write data beyond the allocated boundaries in a buffer on the heap, potentially leading to unauthorized system access or control. The issue lies in the code that creates lookup tables for Huffman trees in WebP files, where a maliciously crafted file can cause data to be written beyond the buffer's allocated space. This flaw opens the door to potential denial of service or remote code execution attacks

Who is Impacted By CVE-2023-4863?

The impact of CVE-2023-4863 is extensive, affecting a wide array of software and applications that rely on the libwebp package. This includes not only Chromium-based applications but also a variety of other systems using libwebp for WebP codec functionality. The broad adoption of this efficient package means that a large number of systems, from individual users to large organizations, are at risk.

Steps to Mitigate CVE-2023-4863 Risks

To protect against the threats posed by CVE-2023-4863, it's vital to update all relevant software. Key updates include:

Google Chrome: Versions 116.0.5845.187/.188 for Mac, Linux, and Windows.
Mozilla Firefox: Versions 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2.
Microsoft Edge: Latest Chromium-based version.
Brave Browser: Version 1.57.64 (Chromium: 116.0.5845.188).

In addition to these browser updates, organizations should leverage Software Bill of Materials (SBOM) to identify and update any instances of the vulnerable libwebp package within their systems.

How CVE-2023-4863 Is Exploited

The flaw is a heap buffer overflow in libwebp's lossless (VP8L) decoder, in the code that builds Huffman tables while parsing an image. A specially crafted WebP file can cause the decoder to allocate an undersized buffer and write past its end, corrupting adjacent heap memory in a way an attacker can shape into code execution. Because the decoder runs automatically whenever an image is displayed, simply rendering a malicious image — in a browser tab, a chat message, or an email preview — can be enough to trigger the bug, which makes it a realistic zero-click vector. The vulnerability was exploited in the wild before patches shipped: it is tied to the BLASTPASS iMessage exploit chain reported by Citizen Lab and Apple in September 2023, and CISA added it to the Known Exploited Vulnerabilities catalog with a binding remediation deadline for US federal agencies.

Why the Scope Goes Far Beyond Chrome

CVE-2023-4863 was first published as a Google Chrome vulnerability, but the defect lives in libwebp itself — the reference WebP library that ships inside thousands of other products. Anything that decodes WebP with a vulnerable copy is exposed: Firefox and Thunderbird, Microsoft Edge, Electron-based desktop apps, Signal, 1Password, Android components, and countless server-side image-processing pipelines. The confusion even led to a second identifier, CVE-2023-5129, being briefly assigned to the library with a maximum CVSS 10.0 score before it was merged back into CVE-2023-4863. The practical lesson for defenders: patching the browser is not enough — every embedded copy of libwebp in your software inventory needs to be found and updated.

Conclusion

CVE-2023-4863 serves as a critical reminder of the importance of cybersecurity vigilance. Regular system updates, following security advisories, and collaborative action across the tech community are essential in mitigating such vulnerabilities. By staying informed and proactive, we can collectively strengthen our defenses against these evolving cyber threats.