CVE-2023-4863: Chromium: CVE-2023-4863 Heap buffer overflow in WebP

CVE-2023-4863 is an edge - chromium vulnerability in Chromium. Microsoft reports that it has been exploited in the wild. It was publicly disclosed before the fix was released. The EPSS model estimates a 99.98% probability of exploitation activity in the next 30 days, higher than 100% of all scored vulnerabilities. Microsoft released the fix on 12 September 2023, outside Patch Tuesday. It affects 4 products in 3 product families (Browser, Windows, Microsoft Office).

Key facts

CVE ID: CVE-2023-4863
Severity: N/A
Impact: Edge - Chromium
Exploited in the wild: Yes
Publicly disclosed: Yes
Weakness: CWE-787
EPSS: 99.98% (percentile 100%)
CISA KEV: Not listed
Released: 12 September 2023
Last updated: 30 October 2025
Patch Tuesday: September 2023 Patch Tuesday
Product families: Browser, Windows, Microsoft Office

Description

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Google is aware that an exploit for CVE-2023-4863 exists in the wild.

Frequently asked questions (Microsoft)

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
Click on Help and Feedback
Click on About Microsoft Edge

How can I find out what version of Teams I am running?

Click on the User Avatar at the top right of the Teams Windows.
Click on About, then Version.
The version will be displayed in the banner below the Search bar.

Where do I get the latest version of Teams?

The latest version of Microsoft Teams can be downloaded at https://teams.microsoft.com/download.

How can I find out what version of Skype I am running?

Select the three dots (...) to the right of your avatar.
Select Settings.
Select Help & Feedback.
The version will be displayed below the Skype logo.

How do I get the updated Webp app?

The Microsoft Store will automatically update affected customers. Alternatively, customers can get the update immediately; see here for details. See Get updates for apps and games in Microsoft Store for more information about how to get app updates.

It is possible for customers to disable automatic updates for the Microsoft Store. The Microsoft Store will not automatically install this update for those customers.

My system is in a disconnected environment; is it vulnerable?

Customers using the Microsoft Store for Business and Microsoft Store for Education can get this update through their organizations.

How can I check if the update is installed?

App package versions 1.0.62681.0 and later contain this update.

You can check the package version in PowerShell: Get-AppxPackage -Name Microsoft.WebpImageExtension

What is the version information for this release?

Microsoft Edge Channel

Microsoft Edge Version

Based on Chromium Version

Date Released

Stable

117.0.2045.31

117.0.5938.62/.63

9/15/2023

Extended Stable

116.0.1938.98

116.0.5845.229

9/27/2023

Version 109

109.0.1518.140

109.0.5414.165

9/15/2023

Affected products (4)

Browser

Product	Security update	Type	Fixed build	Restart
Microsoft Edge (Chromium-based)	Release Notes	Security Update	116.0.1938.81	No

Windows

Product	Security update	Type	Fixed build	Restart
WebP Image Extension	Release Notes	Security Update	1.0.62681.0	No

Microsoft Office

Product	Security update	Type	Fixed build	Restart
Microsoft Teams for Desktop	Release Notes	Security Update	1.6.00.26474	No
Microsoft Teams for Mac, Classic Edition	Release Notes	Security Update	1.6.00.26463	No

Exploitation and detection

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (14)

mistymntncop/CVE-2023-4863 · 320 stars
bbaranoff/CVE-2023-4863 · 6 stars
talbeerysec/BAD-WEBP-CVE-2023-4863 · 3 stars
OITApps/Find-VulnerableElectronVersion · 5 stars
GTGalaxi/ElectronVulnerableVersion · 6 stars
murphysecurity/libwebp-checker · 21 stars
huiwen-yayaya/CVE-2023-4863 · 4 stars
LiveOverflow/webp-CVE-2023-4863 · 56 stars
caoweiquan322/NotEnough · 25 stars
CrackerCat/CVE-2023-4863- · 1 stars
jpsbern/CVE-2023-4863
577Industries/aegisgraph
pixelotes/lab-cve-2023-4863
Shcesama/cve-2023-4863-analysis · 2 stars

NIST NVD data

NVD status: Analyzed
NVD CVSS: 8.8 (HIGH)
NVD weakness: CWE-787
Published to NVD: 12 September 2023
NVD last modified: 24 October 2025

Affected configurations (CPE)

Product	Vulnerable versions
chrome	before 116.0.5845.187
fedora 37	all listed versions
fedora 38	all listed versions
fedora 39	all listed versions
debian linux 10.0	all listed versions
debian linux 11.0	all listed versions
debian linux 12.0	all listed versions
firefox	before 102.15.1
firefox	before 117.0.1
firefox	from 115.1.0, before 115.2.1
thunderbird	before 102.15.1
thunderbird	from 115.0, before 115.2.2
edge chromium	before 116.0.1938.81
teams	before 1.6.00.26463
teams	before 1.6.00.26474
webp image extension	before 1.0.62681.0
libwebp	before 1.3.2
active iq unified manager	all listed versions
seequent leapfrog	before 2023.2
honeyview	before 5.51

References

http://www.openwall.com/lists/oss-security/2023/09/21/4 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/1 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/3 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/4 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/5 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/6 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/7 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/8 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/26/1 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/26/7 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/28/1 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/28/2 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/28/4 (Mailing List)
https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/ (Third Party Advisory)
https://blog.isosceles.com/the-webp-0day/ (Exploit, Third Party Advisory)
https://bugzilla.suse.com/show_bug.cgi?id=1215231 (Issue Tracking, Third Party Advisory)
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html (Vendor Advisory)
https://crbug.com/1479274 (Issue Tracking, Vendor Advisory)
https://en.bandisoft.com/honeyview/history/ (Release Notes)
https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a (Patch)
https://github.com/webmproject/libwebp/releases/tag/v1.3.2 (Release Notes)
https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html (Mailing List, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html (Mailing List, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html (Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/ (Mailing List)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ (Mailing List)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863 (Patch, Third Party Advisory)
https://news.ycombinator.com/item?id=37478403 (Exploit, Third Party Advisory)
https://security-tracker.debian.org/tracker/CVE-2023-4863 (Issue Tracking, Third Party Advisory)
https://security.gentoo.org/glsa/202309-05 (Third Party Advisory)
https://security.gentoo.org/glsa/202401-10 (Third Party Advisory)
https://security.netapp.com/advisory/ntap-20230929-0011/ (Third Party Advisory)
https://sethmlarson.dev/security-developer-in-residence-weekly-report-16 (Exploit)
https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ (Exploit, Third Party Advisory)
https://www.bentley.com/advisories/be-2023-0001/ (Third Party Advisory)
https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/ (Third Party Advisory)
https://www.debian.org/security/2023/dsa-5496 (Mailing List)
https://www.debian.org/security/2023/dsa-5497 (Mailing List)
https://www.debian.org/security/2023/dsa-5498 (Mailing List, Third Party Advisory)
https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/ (Third Party Advisory)
http://www.openwall.com/lists/oss-security/2023/09/21/4 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/1 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/3 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/4 (Mailing List)
http://www.openwall.com/lists/oss-security/2023/09/22/5 (Mailing List)

Revision history

Version	Date	Description
1.0	12 September 2023	Information published.
2.0	30 September 2023	Updated CVE detail with information regarding other Microsoft products affected by this vulnerability. This is an informational change only.
3.0	2 October 2023	Updated CVE detail with information regarding other Microsoft products affected by this vulnerability. Microsoft recommends updating to the latest version of the products listed in the CVE.
3.1	4 October 2023	Updated FAQ information. This is an informational change only.
3.2	11 October 2023	Removed VP9 Video Extensions from the Security Update table as this product is not affected by this vulnerability.
4.0	14 November 2023	Updated CVE detail with information regarding other Microsoft products affected by this vulnerability. Microsoft recommends updating to the latest version of the products listed in the CVE.
4.1	30 October 2025	Updated product information in the Software Update table. This is an informational change only.