TL;DR
- CVE-2023-4863 is a zero-day, heap-based buffer overflow vulnerability in the libwebp library, affecting versions 0.5.0 through 1.3.2.
- Exploitation can result in arbitrary command execution, potentially allowing an attacker to gain control of an affected system or steal sensitive data.
- Because libwebp is used across thousands of applications — including major browsers — patch all affected software as soon as fixes are available.
What happened?
A newly discovered zero-day vulnerability in a web application library (libwebp) can result in arbitrary command execution when exploited. The vulnerability, CVE-2023-4863, is a heap-based buffer overflow vulnerability in the libwebp library, which is used to decode and encode WebP image files. Software using libwebp versions from 0.5.0 to 1.3.2 may be affected.
This vulnerability was originally tracked as CVE-2023-4863 and assigned specifically to Google Chrome. However, the underlying vulnerability itself lies within the libwebp library and consequently affects multiple products that utilize vulnerable versions of the library. To address this scope change, the CVE numbering authority initially added CVE-2023-5129. To reduce confusion, the CVE authority rejected the new CVE designation on September 27, so now CVE-2023-4863 is the only way to track the vulnerability.
Why does it matter?
Many websites and applications leverage the WebP library, meaning the impact of this vulnerability has a far and wide reach (see below for some popular examples). An attacker can exploit the vulnerability by using a specially crafted WebP file that can result in crashes or arbitrary command execution. This could allow an attacker to gain control of an affected system or steal sensitive data.
What are we doing for our customers?
Expel’s Detection and Response team is continuing to monitor for any activity associated with the vulnerability and we will continue to assess any potential threat hunting opportunities.
Expel’s Vulnerability Prioritization (VP) team has notified our customers, who had multiple instances of CVE-2023-4863 vulnerabilities and impacted assets. Additionally, Expel VP also provided communication to each customer that we had vulnerability visibility to their CVE-2023-4863 risk.
What should you do right now?
The full scope of affected products is still unknown. However, many vendors have already begun releasing patches applying the necessary fixes. Where available, patch all affected software that utilizes libwebp versions 0.5.0 to 1.3.2.
Thousands of applications are potentially affected. Popular examples include:
- Google Chrome
- Microsoft Edge
- Mozilla FireFox
- Safari
- Multiple professional and personal messaging apps and email platforms
- Free online image processing and office software
Strategically, we recommend using scanner tools to identify impacted software. Specifically look for CVE-2023-4863.
What next?
We’ll update this post with any big developments, but keep an eye on our socials (@ExpelSecurity) for additional recommendations as they emerge.
Frequently asked questions
What is CVE-2023-4863?
A zero-day, heap-based buffer overflow vulnerability in the libwebp library used to decode and encode WebP image files, which can lead to crashes or arbitrary command execution when exploited with a specially crafted WebP file.
Which libwebp versions are affected by CVE-2023-4863?
Versions 0.5.0 through 1.3.2.
What products are impacted by the libwebp vulnerability?
Thousands of applications, including Google Chrome, Microsoft Edge, Mozilla Firefox, Safari, and numerous messaging apps, email platforms, and image-processing or office software that use libwebp.
Why was CVE-2023-5129 rejected in favor of CVE-2023-4863?
CVE-2023-4863 was originally assigned specifically to Google Chrome, and CVE-2023-5129 was added when the scope was found to extend to the underlying libwebp library. To reduce confusion, the CVE authority rejected the new designation on September 27, leaving CVE-2023-4863 as the single tracking identifier.
How can I check if my organization is affected by CVE-2023-4863?
Use scanner tools to identify software using libwebp versions 0.5.0 through 1.3.2, and specifically search for CVE-2023-4863 in your vulnerability management or scanning platform.
