CVE-2023-4863

This vulnerability is a flaw in how certain image/web rendering code handles specially crafted web content. If someone tricks a user into opening a malicious page, it may write into memory it shouldn’t, which can crash the browser or enable a takeover. Think of it like a “buffer” inside the app that can be forced to overflow with the wrong kind of input, potentially letting an attacker steer what the program does next.

This matters if your business uses or ships software that includes libwebp or affects web-rendering apps like google chrome, firefox, thunderbird, edge chromium, or teams, or if you use webp image extensions. A remote attacker can trigger it by getting you to visit a crafted HTML page, and there is no special login required. It’s a risk when an attacker can reach a user via the web (for example, sending a link that the user opens in an affected app).

This is RED because it is included in CISA KEV and has public exploit availability, meaning real attackers have had a clear path to weaponize it. It was also not just a theoretical issue: it’s been resurfacing in security attention, and attackers have used Chromium-related components in the wild in the context of ransomware activity.

1. Inventory and version check (quick):

   • Identify endpoints and environments where users browse or view web content with: google chrome, firefox, thunderbird, edge chromium, teams.
   • Also check whether your line-of-business apps or tools rely on a bundled libwebp / webp image extension component.
   • Record the currently installed versions.

2. Confirm exposure against fixed versions:

   • google chrome: vulnerable if before 116.0.5845.187; fixed in 116.0.5845.187.
   • firefox: vulnerable if before 102.15.1; fixed in 102.15.1.
   • thunderbird: vulnerable if before 102.15.1; fixed in 102.15.1.
   • edge chromium: vulnerable if before 116.0.1938.81; fixed in 116.0.1938.81.
   • teams: vulnerable if before 1.6.00.26463; fixed in 1.6.00.26463.
   • webp image extension: vulnerable if before 1.0.62681.0; fixed in 1.0.62681.0.
   • libwebp: vulnerable if before 1.3.2; fixed in 1.3.2.

3. Upgrade/patch plan (prioritize):

   • First patch the most exposed user paths: browsers used to open emails and links (Chrome/Edge/Teams).
   • Then patch Firefox/Thunderbird where those are used.
   • Patch any relevant server-side or desktop software components that bundle libwebp/webp extension.

4. Workaround if patching is delayed:

   • Reduce exposure to untrusted content: temporarily limit browsing to trusted sites for users on affected apps.
   • Treat inbound links/emails as higher risk until updates are complete (because the trigger is visiting a crafted HTML page).

5. Timing guidance (CISA KEV):

   • CISA KEV due date for remediation was 2023-10-04. If you haven’t patched since then, upgrade immediately according to your vendor’s guidance.

6. What to monitor after updating:

   • Verify the versions actually changed to the fixed ones.
   • Watch for unexpected crashes of the affected apps (which can be an indicator of attempted exploitation attempts, even if no takeover occurred).
   • Keep an eye on user-reported suspicious pages or phishing attempts during the rollout window.

Severity and type: High-impact memory corruption (CWE-787) in libwebp leading to a heap buffer overflow and out-of-bounds memory write, with potential for arbitrary code execution or crashes. Attack vector and triggering: remote via visiting a crafted HTML page; no authentication required; user interaction is required (a user must open/visit the content). Exploitation status: listed in CISA KEV (added 2023-09-13) with a CISA remediation due date of 2023-10-04; public exploit exists (1 known). Exploit maturity is therefore beyond proof-of-concept and considered actionable. EPSS information exists but is not used to drive the decision because KEV confirmation has higher precedence. KEV meaning: CISA maintains a catalog of vulnerabilities known to be exploited in the wild, and that drives mandated remediation timelines.