CVE-2023-4863 (WebP 0-day) — libwebp: OOB write in electron — CVE...
HIGH
libwebp: OOB write in BuildHuffmanTable
Published September 12, 2023Updated September 10, 2026Source: osv
Summary
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Advisory Timeline
- First published September 12, 2023 (1126 days ago).
- Last revised September 10, 2026 — 1094 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
npm
Update electron to 25.8.1 or laternpm install electron@25.8.1
Cargo
Update libwebp-sys2 to 0.1.8 or latercargo update -p libwebp-sys2 --precise 0.1.8
npm
Update electron to 22.3.24 or laternpm install electron@22.3.24
npm
Update electron to 24.8.3 or laternpm install electron@24.8.3
NuGet
Update magick.net-q8-openmp-x64 to 13.3.0 or laterdotnet add package magick.net-q8-openmp-x64 --version 13.3.0
Go
Update github.com/chai2010/webp to 1.1.2-0.20250406010349-76805d5a8860 or latergo get github.com/chai2010/webp@v1.1.2-0.20250406010349-76805d5a8860
NuGet
Update SkiaSharp to 2.88.6 or laterdotnet add package SkiaSharp --version 2.88.6
NuGet
Update magick.net-q16-anycpu to 13.3.0 or laterdotnet add package magick.net-q16-anycpu --version 13.3.0
NuGet
Update magick.net-q16-x64 to 13.3.0 or laterdotnet add package magick.net-q16-x64 --version 13.3.0
NuGet
Update magick.net-q8-x64 to 13.3.0 or laterdotnet add package magick.net-q8-x64 --version 13.3.0
npm
Update electron to 27.0.0-beta.2 or laternpm install electron@27.0.0-beta.2
npm
Update electron to 26.2.1 or laternpm install electron@26.2.1
Go
Update github.com/chai2010/webp to 1.4.0 or latergo get github.com/chai2010/webp@v1.4.0
NuGet
Update magick.net-q16-hdri-anycpu to 13.3.0 or laterdotnet add package magick.net-q16-hdri-anycpu --version 13.3.0
Go
Update github.com/chai2010/webp to 0.0.0-20250406010349-76805d5a8860 or latergo get github.com/chai2010/webp@v0.0.0-20250406010349-76805d5a8860
Cargo
Update webp to 0.2.6 or latercargo update -p webp --precise 0.2.6
NuGet
Update magick.net-q8-anycpu to 13.3.0 or laterdotnet add package magick.net-q8-anycpu --version 13.3.0
pip
Update pillow to 10.0.1 or laterpip install "pillow>=10.0.1"
Cargo
Update libwebp-sys to 0.9.3 or latercargo update -p libwebp-sys --precise 0.9.3
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (19)
Affects 5 ecosystems: nuget (7), crates.io (3), go (1), npm (1), pypi (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| electron | npm | All versions | 25.8.1 |
| libwebp-sys2 | crates.io | All versions | 0.1.8 |
| electron | npm | All versions | 22.3.24 |
| electron | npm | All versions | 24.8.3 |
| magick.net-q8-openmp-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+77 more) | 13.3.0 |
| github.com/chai2010/webp | go | All versions | 1.1.2-0.20250406010349-76805d5a8860 |
| SkiaSharp | nuget | 2.80.0, 2.80.1, 2.80.2, 2.80.3 (+7 more) | 2.88.6 |
| magick.net-q16-anycpu | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+180 more) | 13.3.0 |
| magick.net-q16-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+196 more) | 13.3.0 |
| magick.net-q8-x64 | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+196 more) | 13.3.0 |
| electron | npm | All versions | 27.0.0-beta.2 |
| electron | npm | All versions | 26.2.1 |
| github.com/chai2010/webp | go | All versions | 1.4.0 |
| magick.net-q16-hdri-anycpu | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+177 more) | 13.3.0 |
| github.com/chai2010/webp | go | All versions | 0.0.0-20250406010349-76805d5a8860 |
| webp | crates.io | All versions | 0.2.6 |
| magick.net-q8-anycpu | nuget | 10.0.0, 10.1.0, 11.0.0, 11.1.0 (+180 more) | 13.3.0 |
| pillow | pypi | 1.0, 1.1, 1.2, 1.3 (+89 more) | 10.0.1 |
| libwebp-sys | crates.io | All versions | 0.9.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-787Out-of-bounds WriteMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863ADVISORY
- https://github.com/qnighy/libwebp-sys2-rs/pull/21WEB
- https://github.com/python-pillow/Pillow/pull/7395WEB
- https://github.com/jaredforth/webp/pull/30WEB
- https://github.com/electron/electron/pull/39823WEB
- https://github.com/electron/electron/pull/39825WEB
- https://github.com/electron/electron/pull/39826WEB
- https://github.com/electron/electron/pull/39827WEB
- https://github.com/electron/electron/pull/39828WEB
- https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17aWEB
- https://github.com/qnighy/libwebp-sys2-rs/commit/4560c473a76ec8bd8c650f19ddf9d7a44f719f8bWEB
- https://github.com/jaredforth/webp/commit/9d4c56e63abecc777df71c702503c3eaabd7dcbcWEB
- https://security.gentoo.org/glsa/202401-10WEB
- https://security.gentoo.org/glsa/202309-05WEB
- https://security-tracker.debian.org/tracker/CVE-2023-4863WEB
- https://rustsec.org/advisories/RUSTSEC-2023-0061.htmlWEB
- https://rustsec.org/advisories/RUSTSEC-2023-0060.htmlWEB
- https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html#securityWEB
- https://news.ycombinator.com/item?id=37478403WEB
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863WEB
- https://adamcaudill.com/2023/09/14/whose-cve-is-it-anywayWEB
- https://security.netapp.com/advisory/ntap-20230929-0011WEB
- https://sethmlarson.dev/security-developer-in-residence-weekly-report-16WEB
- https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863WEB
- https://www.bentley.com/advisories/be-2023-0001WEB
- https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacksWEB
- https://www.debian.org/security/2023/dsa-5496WEB
- https://www.debian.org/security/2023/dsa-5497WEB
- https://www.debian.org/security/2023/dsa-5498WEB
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-40WEB
- https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863WEB
- https://blog.isosceles.com/the-webp-0dayWEB
- https://bugzilla.suse.com/show_bug.cgi?id=1215231WEB
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.htmlWEB
- https://crbug.com/1479274WEB
- https://en.bandisoft.com/honeyview/historyWEB
- https://github.com/ImageMagick/ImageMagick/discussions/6664WEB
- https://github.com/dlemstra/Magick.NET/releases/tag/13.3.0WEB
- https://github.com/webmproject/libwebpPACKAGE
- https://github.com/webmproject/libwebp/releases/tag/v1.3.2WEB
- https://lists.debian.org/debian-lts-announce/2023/09/msg00015.htmlWEB
- https://lists.debian.org/debian-lts-announce/2023/09/msg00016.htmlWEB
- https://lists.debian.org/debian-lts-announce/2023/09/msg00017.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVTWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFXWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCXWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDBWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4IWEB
- https://www.openwall.com/lists/oss-security/2023/09/21/4WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/1WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/3WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/4WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/5WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/6WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/7WEB
- https://www.openwall.com/lists/oss-security/2023/09/22/8WEB
- https://www.openwall.com/lists/oss-security/2023/09/26/1WEB
- https://www.openwall.com/lists/oss-security/2023/09/26/7WEB
- https://www.openwall.com/lists/oss-security/2023/09/28/1WEB
- https://www.openwall.com/lists/oss-security/2023/09/28/2WEB
- https://www.openwall.com/lists/oss-security/2023/09/28/4WEB
Frequently Asked Questions
- What is CVE-2023-4863?
- libwebp: OOB write in BuildHuffmanTable This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
- How do I check if my project is affected by CVE-2023-4863?
- CVE-2023-4863 affects electron, libwebp-sys2 and magick.net-q8-openmp-x64 (and 10 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-4863 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
8.8
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-j7hp-h8jx-5ppr
A-299477569
ASB-A-299477569
CVE-2023-5129
PYSEC-2026-1794
RUSTSEC-2023-0060
RUSTSEC-2023-0061
Related CVEs
- CVE-2026-25968HIGH
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
- CVE-2026-33536MEDIUM
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
- CVE-2026-53467MEDIUM
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
- CVE-2026-25637MEDIUM
ImageMagick: Possible memory leak in ASHLAR encoder
- CVE-2026-53463MEDIUM
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
- CVE-2026-33905MEDIUM
ImageMagick has an out-of-bounds read in sample operation
- CVE-2026-56373LOW
mageMagick has a possible use-after-free write in its PDB decoder
- CVE-2026-56363LOW
ImageMagick: Division by Zero in binomial kernel
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies