Critical libwebp Vulnerability in Browsers: Urgent Update Required
CVE-2023-4863 is an actively exploited out-of-bounds write in libwebp that can cause crashes, arbitrary code execution and unauthorized data access through crafted WebP images. It affects software using the WebP codec, including major browsers; update browsers to the latest version, with Chrome fixed in 116.0.5845.187.
Summary written with AI from this article, and checked against it.
At a glanceCVE-2023-5129
CVE-2023-5129 has no CVSS score yet. No fixed version has been published yet.
| Severity | Not scored yet (NVD: Rejected) |
|---|---|
| Fixed in | No fixed version published yet |
| Affected | Not published yet |
| Exploited | Not in CISA's Known Exploited Vulnerabilities catalog |
| Public exploit | None listed by NVD or on GitHub |
| Ubuntu | Not tracked yet |
| Debian | Listed, no packages yet |
| Red Hat | Fixed: RHEL 7 (RHSA-2023:5191, RHSA-2023:5197), RHEL 8 (RHSA-2023:5184, RHSA-2023:5201, RHSA-2023:5309), RHEL 8.1 Update Services for SAP Solutions (RHSA-2023:5183, RHSA-2023:5188, RHSA-2023:5236) · RHEL 6: Out of support scope, RHEL 9: Affected, RHEL 9: Affected |
Is there a public exploit for CVE-2023-5129?
No public exploit is listed as of October 28, 2026: NVD lists no exploit reference, no public GitHub repository names it, and it is not in CISA's Known Exploited Vulnerabilities catalog.
At a glanceCVE-2023-4863
CVE-2023-4863 has a CVSS 3.1 base score of 8.8 (High) from NVD. It is fixed in Chrome 116.0.5845.187. Debian bookworm fixed it in chromium 150.0.7871.100-1~deb12u1.
| Severity | 8.8 High (CVSS 3.1, NVD) |
|---|---|
| Fixed in | Chrome 116.0.5845.187 |
| Affected | Chrome before 116.0.5845.187 |
| Exploited | Yes: in CISA's Known Exploited Vulnerabilities catalog since September 13, 2023 |
| EPSS | Over 99.9% chance of exploitation in the next 30 days (FIRST, October 27, 2026) |
| Public exploit | blog.isosceles.com, news.ycombinator.com, sethmlarson.dev, stackdiary.com, blog.isosceles.com · 14 GitHub repositories name it: proofs of concept, scanners, detections. Unverified: some are fake or malicious. |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Weakness | CWE-787 Out-of-bounds Write |
| Ubuntu | Not tracked yet |
| Debian | bookworm chromium: Fixed (150.0.7871.100-1~deb12u1) · trixie chromium: Fixed (150.0.7871.181-1~deb13u1) · forky, sid chromium: Fixed (156.0.8078.47-1) · sid firefox: Fixed (158.0.1-1) · bookworm firefox-esr: Fixed (140.12.0esr-1~deb12u1) · trixie firefox-esr: Fixed (140.15.0esr-1~deb13u1) |
| Red Hat | Fixed: RHEL 7 (RHSA-2023:5191, RHSA-2023:5197), RHEL 8 (RHSA-2023:5184, RHSA-2023:5201, RHSA-2023:5309), RHEL 8.1 Update Services for SAP Solutions (RHSA-2023:5183, RHSA-2023:5188, RHSA-2023:5236) · RHEL 6: Out of support scope |
| Also in | Fedoraproject fedora, Debian debian linux, Firefox, Mozilla thunderbird, Microsoft edge chromium, Microsoft teams |
Is there a public exploit for CVE-2023-4863?
Yes: CVE-2023-4863 is exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on September 13, 2023. NVD links 5 exploit references and 14 public GitHub repositories name it: proofs of concept, scanners and detections. None of it is verified: some such repositories are fake or carry malware, so read the code before running it, and only against systems you own. FIRST's EPSS puts the chance of exploitation in the next 30 days at over 99.9%, higher than 99.9% of scored CVEs.
A critical zero-day vulnerability in the libwebp image library, essential for rendering WebP format images, is under active exploitation. Initially marked as CVE-2023-5129 but later identified as a duplicate of CVE-2023-4863, this vulnerability poses a significant risk to various software applications, including major web browsers based on Google's Chromium project.
Overview of the Vulnerability
The libwebp library, integral to the Chromium project, has been found to contain a critical flaw (CVE-2023-4863) that can be exploited through a specially crafted WebP lossless file, causing data to be written beyond heap boundaries. This issue stems from the HuffmanCode buffer allocation within the ReadHuffmanCodes() function, leading to potential problems when building Huffman tables for second-level lookups.
Implications of the Vulnerability
This vulnerability can lead to severe consequences, including application crashes, arbitrary code execution, and unauthorized data access. It affects all software utilizing the WebP codec, notably major browsers like Chrome, Firefox, Safari, and Edge. The exploit allows attackers to execute out-of-bounds memory writes through malicious HTML pages, making it a critical security concern.
Google's Response and CVE Clarification
Google initially assigned CVE-2023-5129 to this vulnerability but later rejected it, marking it as a duplicate of CVE-2023-4863. This decision seems pragmatic, considering multiple vendors had already adopted CVE-2023-4863 to address the libwebp issue. Google revised CVE-2023-4863’s description to cover its impact on libwebp, explicitly highlighting its critical impact on Chromium.
Recommendations for Users and System Administrators
- Apply Updates Immediately: Users should urgently upgrade their web browsers to the latest version. This update is crucial for mitigating the risk posed by this vulnerability.
- Automated Application Patch Management: Implementing automated patch management for application updates on enterprise assets is recommended. Conducting these updates on a monthly or more frequent basis ensures continuous protection against potential exploits.
Conclusion
The discovery of this critical zero-day vulnerability in the libwebp library underscores the importance of timely software updates and vigilant cybersecurity practices. With the potential to affect a wide range of software applications, particularly major web browsers, immediate action is required to safeguard against this threat.
In today’s digital landscape, where vulnerabilities like CVE-2023-4863 can have widespread implications, staying informed and proactive in applying software updates is key to maintaining online security. Users and organizations must prioritize regular updates and patch management to protect against evolving cyber threats.
Interview flashcards
What causes the libwebp vulnerability CVE-2023-4863?
The flaw stems from HuffmanCode buffer allocation in ReadHuffmanCodes() when building Huffman tables for second-level lookups. A specially crafted WebP lossless file can cause data to be written beyond heap boundaries.
How can attackers exploit CVE-2023-4863 through a browser?
Attackers can use malicious HTML pages to trigger out-of-bounds memory writes through a specially crafted WebP lossless file. The vulnerability is under active exploitation.
What are the potential consequences of exploiting CVE-2023-4863?
Exploitation can cause application crashes, arbitrary code execution, and unauthorized data access.
Which applications are affected by the libwebp vulnerability?
The vulnerability affects all software utilizing the WebP codec, including major browsers such as Chrome, Firefox, Safari, and Edge.
Why was CVE-2023-5129 rejected in favor of CVE-2023-4863?
Google rejected CVE-2023-5129 as a duplicate of CVE-2023-4863, which multiple vendors had already adopted for the libwebp issue. Google revised the existing description to cover libwebp and highlight its critical impact on Chromium.
What should users do immediately to mitigate the libwebp vulnerability?
Users should urgently upgrade their web browsers to the latest version. Applying these updates is crucial for mitigating the risk posed by the vulnerability.
What patch management approach is recommended for enterprise applications?
Automated application patch management is recommended for enterprise assets. Updates should be conducted monthly or more frequently to maintain protection against potential exploits.
Written with AI from this article, and checked against it.
Sources
- CVE recordCVE-2023-5129 in the National Vulnerability Database · nvd.nist.gov
- CVE recordCVE-2023-4863 in the National Vulnerability Database · nvd.nist.gov
About the author
Vishal · Software & security engineerVishal writes Trickyworld's tutorials and interview-preparation guides on programming, databases, cyber security and AI. Vishal has been shipping production software long enough to have firm opinions about Python, PHP, Node.js, and JavaScript, and to have been wrong about each of them at least once. The work has run the whole stack: Drupal and Laravel applications, React front ends, MySQL and MongoDB underneath, Redis and Memcached for the things that had to be fast, Apache Solr for the things that had to be findable. That last part turned out to matter more than anyone expected. Tune a Solr index for a season, then watch a language model confidently retrieve the wrong document, and you recognise an old problem wearing new clothes. Most of what is hard about AI systems is not the model. It is retrieval, caching, latency budgets, and deciding what the system does when the answer comes back wrong — which is work he has been doing since well before anyone called it AI engineering. He plays a lot of games, which is less a hobby disclosure than an admission of where a good share of his engineering instinct came from. Real-time systems with a frame budget. State that has to stay coherent while a player does something no designer anticipated. The permanent question of what happens when the frame cannot finish in time. Those habits carry over more directly than they have any right to. He has written several books on programming, all built on the same conviction: most technical writing is unclear because the author never decided what to leave out. More from Vishal → · Editorial policy
