CVE-2023-4863: listed in the CISA KEV catalog

CVE-2023-4863 · CVSS 8.8 HIGH · EPSS 100.0% · KEV 2023-09-13 · patch available

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Is CVE-2023-4863 exploited?

• Listed in the CISA KEV catalog on 2023-09-13.
• Federal remediation due 2023-10-04.
• Past that date by 1121 days.
• EPSS puts exploitation in the next 30 days at 100.0%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Google · Chrome · >= 116.0.5845.187, < 116.0.5845.187
• Google · libwebp · >= 1.3.2, < 1.3.2
• fedoraproject · fedora · 37, 38, 39
• debian · debian linux · 10.0, 11.0, 12.0
• mozilla · firefox · < 102.15.1, < 117.0.1, >= 115.1.0, < 115.2.1
• mozilla · thunderbird · < 102.15.1, >= 115.0, < 115.2.2
• microsoft · edge chromium · < 116.0.1938.81
• microsoft · teams · < 1.6.00.26463, < 1.6.00.26474
• microsoft · webp image extension · < 1.0.62681.0
• netapp · active iq unified manager
• bentley · seequent leapfrog · < 2023.2
• bandisoft · honeyview · < 5.51

Is there a patch?

Yes. Update to one of these or later:

From NVD's analysis

What PlainSec published about CVE-2023-4863

• Mitsubishi Electric flaws span code execution and access bypass (2026-10-28)
• Google Cloud split its patch duty in two (2026-08-26)
• Node kernel bugs on GKE COS nodes enable host escalation (2026-04-15)
• Google Cloud issues multiple Linux kernel privilege escalation fixes for GKE nodes (2026-04-07)
• Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
• Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)

Primary sources

• NVD record
• CISA KEV catalog
• Google advisory

KEV and EPSS are re-checked daily. Record last updated 2026-10-27.