Loading CVE intelligence

CVE-2023-4863

HighPublished

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Published: Sep 12, 2023
Updated: Oct 21, 2025
Assigning CNA: Chrome
Evidence observed: Sep 13, 2023

Primary CVSS

8.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability estimate

100.0%

High · next 30 days

Percentile: 100.0%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Sources

10

CVE-2023-4863PoC
Proof-of-concept exploit for CVE-2023-4863, a heap buffer overflow in libwebp, demonstrating crash trigger and reproduction steps with AddressSanitizer.
NotEnoughExploit
This tool calculates tricky canonical huffman histogram for CVE-2023-4863.
CVE-2023-4863-PoC
Triggering the famous libweb 0day vuln with libfuzzer
PoC

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

PoC

Curated proof-of-concept exploits for real-world CVEs affecting iOS, macOS, Chrome Renderer, and Steam clients, with version-specific targets and technical write-up references.

CVE-2023-4863PoC

Reproduction and exploitation of CVE-2023-4863, a heap-buffer-overflow in libwebp's Huffman table builder, with crafted WebP images and ASAN-verified proof-of-concept code.

CVE-2023-4863Exploit

Generates WebP images that trigger CVE-2023-4863 heap buffer overflow in libwebp, using tunable OFFSET/VALUE constants for exploit testing and validation.

webp-CVE-2023-4863PoC

Educational repository demonstrating CVE-2023-4863 exploitation in libwebp using AFL++ fuzzing, with step-by-step video walkthroughs for vulnerability analysis and binary exploitation.

CVE-2023-4863PoC

Proof-of-concept for CVE-2023-4863, a heap buffer overflow in WebP image decoding. Demonstrates the code_lengths trigger mechanism discovered by @benhawkes for educational analysis.

lab-cve-2023-4863PoC

Docker-based lab to reproduce CVE-2023-4863 (heap buffer overflow in libwebp) with automated crash demonstration, patched vs vulnerable comparison, and GUI-based browser exploitation in an isolated network.

BAD-WEBP-CVE-2023-4863PoC

BAD-WEBP-CVE-2023-4863