[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is CVE-2023-4863? Google's libwebp at risk](/blog/libwebp-cve-2023) Publish date January 8, 2025 {x} minute read # What is CVE-2023-4863? Google's libwebp at risk [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) WebP is an open-source image format developed by Google. WebP enables higher quality images in smaller file sizes. The \[.rt-script]libwebp\[.rt-script] package, released by Google, encodes and decodes images in WebP format and is used widely across the internet for lossless image compression. The image parsing library \[.rt-script]libwebp\[.rt-script] is the core of the recently identified [CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) heap buffer overflow vulnerability and zero-day exploit that impacts Google Chrome and other Chromium-based browsers for Windows, macOS, and Linux, as well as any software or web application that uses the \[.rt-script]libwebp\[.rt-script] library. ## What is CVE 2023-4863? CVE-2023-4863 is a zero-day vulnerability that allows for remote code execution and out-of-bounds write through a buffer overflow attack. Though there are reports of active exploitation, details about those attacks have not yet been made available. It seems that a malicious WebP image on a crafted HTML page can enable a remote attacker to gain permissions for an out-of-bounds memory write. Because of how the WebP Codec provides support for web images, a heap overflow vulnerability permits exploitation of WebP image provisions. The image-based exploitation is related to WebP's lossless compression through the Huffman coding algorithm. If an attacker overflows the algorithmic data and replaces it with their own maliciously crafted image data, then the attacker can gain access to the victim's device and run code. Simply accessing the malicious image on the web page can trigger this vulnerability without any further user interaction. This vulnerability is a known Chrome zero-day exploit, but it extends beyond just web browsers. CVE-2023-4863 follows the recent [CVE-2023-41064](https://nvd.nist.gov/vuln/detail/CVE-2023-41064) discovery by the Citizen Lab. CVE-2023-4104, also known as the BLASTPASS exploitation, deploys Pegasus spyware through zero-click iMessage images. The Citizen Lab reported this issue to Apple and, together with Apple's Security and Engineering Architecture team, they notified Google about potential exploitation beyond Mac-based products. With the WebP format used widely and the \[.rt-script]libwebp\[.rt-script] library, specifically, in use among many browsers, applications, and software, this vulnerability could have extensive implications across the web. Any software using \[.rt-script]libwebp\[.rt-script] may be vulnerable. While usage does not necessarily correlate with exploitability, any use of this package should be investigated to confirm whether or not the use is vulnerable to the exploit. CVE-2023-4863 is the vulnerability's identification in NIST's National Vulnerability Database (this critical vulnerability was briefly re-registered as CVE-2023-5129 and then withdrawn). This vulnerability has a CVSS score of 8.8, which indicates a high severity. While the CVSS base score does not identify the measure of risk, the widespread use of \[.rt-script]libwebp\[.rt-script] and reports of active exploitation suggest that there may be lasting effects among web users. ## Who is Impacted By CVE-2023-4863? Due to the extensive use of \[.rt-script]libwebp\[.rt-script] across the web, it is difficult to identify the exact parameters of this vulnerability. However, the widespread implementation of this library means that many sites and applications may be vulnerable but would need further investigation to know definitively. Website and application developers can check the application's source code to determine the use of \[.rt-script]libwebp\[.rt-script] and to upgrade to a secure version. Further, you can audit your Software Bill of Materials (SBOM) to determine exposure among your software libraries. Since many packages rely on libwebp, it is imperative that developers review the application build to ensure their stack is updated to the fixed version. Rezilion has [identified the package in use among popular CMS frameworks like WordPress and Drupal and a variety of Docker container images](https://www.rezilion.com/blog/rezilion-researchers-uncover-new-details-on-severity-of-google-chrome-zero-day-vulnerability-cve-2023-4863/). Additionally, many Linux-based operating systems have released security fixes for their builds, including [Alpine](https://security.alpinelinux.org/vuln/CVE-2023-4863), [Debian](https://security-tracker.debian.org/tracker/CVE-2023-4863), [Gentoo](https://security.gentoo.org/glsa/202309-05), [Oracle](https://linux.oracle.com/cve/CVE-2023-4863.html), [Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=2238431), [SUSE](https://www.suse.com/security/cve/CVE-2023-4863.html), and [Ubuntu](https://ubuntu.com/security/CVE-2023-4863). If you identify that your software, applications, or packages incorporate the \[.rt-script]libwebp\[.rt-script] library, take action to update it immediately to the latest version. Once the security upgrade has been applied, ensure that you restart applications for the changes to take effect. Follow your existing [vulnerability remediation](https://www.upguard.com/blog/vulnerability-remediation) process so that this update minimizes operational interruption. All web users should follow the recommended update schedule to install fixes for products with known version updates. Google Chrome has [released an update for use across macOs, Linux, and Windows](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) that is currently available or will be available to all users in the very near future. Apple has also [released a security update for iOS and iPadOS](https://support.apple.com/en-us/HT213905). Likewise, other Chromium-based web browsers have released fixes, including [Brave Browser](https://github.com/brave/brave-browser/releases/tag/v1.57.64), [Microsoft Edge](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863), [Mozilla Firefox](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/), [Opera](https://blogs.opera.com/desktop/2023/09/opera-102-0-4880-51-stable-update/), [Tor Browser](https://blog.torproject.org/new-release-tor-browser-1254/), and [Vivaldi](https://vivaldi.com/blog/desktop/minor-update-three-6-2/). Other applications, like [1Password](https://support.1password.com/kb/202309/) and [Electron](https://github.com/electron/electron/pull/39828), are also releasing updates as they can. For third party vendors, source code will generally not be available. As vendors complete their own assessment of \[.rt-script]libwebp\[.rt-script] usage, they may publish information on which versions of their products are vulnerable. Because the potential attack surface is extensive, vendors need to complete internal investigations and communicate the status for their products. ## What You Can Do About CVE-2023-4863 Because \[.rt-script]libwebp\[.rt-script] is used extensively across the web, it is critical that updates are applied as quickly as possible to achieve widespread uptake. It may take some time for the security upgrade to become in use. You can take these three actions to ensure that you implement cybersecurity updates: * Apply all the security updates for browsers, apps, and operating systems. * Identify if your applications use \[.rt-script]libwebp\[.rt-script] directly or as a dependency, then upgrade to a secure version. * Open a line of communication with your vendors to remain updated about their use of \[.rt-script]libwebp\[.rt-script]. When products are known to be affected and added to the NVD listing for CVE-2023-4863, they will be added to the UpGuard vulnerability library. UpGuard will continue monitoring the situation for more information on which products and which versions of those are affected. ‍ eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)