CVE-2023-4863 is a critical security vulnerability affecting the WebP image format library, specifically in the libwebp component. Here’s a detailed breakdown:

Overview

• CVE ID: CVE-2023-4863
• Severity: Critical (CVSS score: 8.8)
• Affected Component: libwebp (a library for encoding/decoding WebP images)
• Vulnerability Type: Heap buffer overflow (out-of-bounds write)
• Impact: Remote code execution (RCE), application crashes, or sandbox escapes.

Technical Details

• Root Cause: A flaw in the lossless WebP decoding functionality (libwebp/src/dsp/lossless.c).
  • Improper bounds checking during image processing allows attackers to write data beyond allocated heap buffers.
• Trigger: Processing a maliciously crafted WebP image.
• Exploitation:
  • Can lead to arbitrary code execution in the context of the application using libwebp.
  • Particularly dangerous in browsers, messaging apps, or any software that processes untrusted images.

Affected Software

• Google Chrome (versions prior to 117.0.5938.92)
• Mozilla Firefox (versions prior to 118.0)
• Apple Safari (iOS/iPadOS/macOS versions prior to updates in September 2023)
• Other software using libwebp:
  • WhatsApp, Signal, Discord, and many image-processing tools.
  • Any application embedding libwebp ≤ v1.3.1.

Patches & Fixes

• libwebp: Fixed in v1.3.2 (released September 2023).
• Vendor Updates:
  • Chrome: Patched in v117.0.5938.92 (September 12, 2023).
  • Firefox: Patched in v118.0 (September 26, 2023).
  • Apple: Fixed in iOS 17, iPadOS 17, macOS Sonoma (September 2023 updates).

Mitigation Steps

1. Update Immediately:
   • Upgrade browsers, OS, and applications to patched versions.
   • Ensure libwebp is updated to ≥ v1.3.2 in custom software.
2. Restrict Image Processing:
   • Avoid processing untrusted WebP files in critical systems.
   • Use sandboxing for image decoding (e.g., Chrome’s renderer sandbox).
3. Monitor:
   • Watch for unusual crashes or memory corruption in apps handling images.

Why It Matters

• Widespread Impact: WebP is used by >90% of top websites (via Chrome/Firefox support).
• Exploitation Risk: Actively exploited in the wild (e.g., zero-click attacks via messaging apps).
• Sandbox Escape: In Chrome, this bug bypassed security mitigations, allowing full RCE.

References

• NVD Entry
• Google Security Advisory
• Mozilla Advisory
• Apple Security Updates

Action Required: If you manage systems or software using WebP, patch immediately. Unpatched systems are at high risk of compromise.