{
  "published": "2025-10-30T22:25:15Z",
  "modified": "2026-01-07T00:00:00Z",
  "schema_version": "1.7.5",
  "id": "CGA-25fp-99h9-mfx8",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
  "upstream": [
    "CVE-2023-4863",
    "GHSA-j7hp-h8jx-5ppr"
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/202309-05"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.bentley.com/advisories/be-2023-0001/"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.debian.org/security/2023/dsa-5498"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.gentoo.org/glsa/202401-10"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.netapp.com/advisory/ntap-20230929-0011/"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1215231"
    },
    {
      "type": "FIX",
      "url": "https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/21/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/5"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/6"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/7"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/22/8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/26/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/26/7"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/28/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/28/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/09/28/4"
    },
    {
      "type": "WEB",
      "url": "https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1479274"
    },
    {
      "type": "WEB",
      "url": "https://en.bandisoft.com/honeyview/history/"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webmproject/libwebp/releases/tag/v1.3.2"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=37478403"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2023-4863"
    },
    {
      "type": "WEB",
      "url": "https://sethmlarson.dev/security-developer-in-residence-weekly-report-16"
    },
    {
      "type": "WEB",
      "url": "https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/"
    },
    {
      "type": "WEB",
      "url": "https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4863.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.debian.org/security/2023/dsa-5496"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.debian.org/security/2023/dsa-5497"
    },
    {
      "type": "ARTICLE",
      "url": "https://blog.isosceles.com/the-webp-0day/"
    },
    {
      "type": "ARTICLE",
      "url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Chainguard",
        "name": "libwebp",
        "purl": "pkg:apk/chainguard/libwebp?arch=x86_64"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1-r2"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "components": [
          {
            "component_name": "libwebp",
            "component_version": "",
            "component_type": "apk",
            "component_location": "/.PKGINFO",
            "component_purl": "pkg:apk/libwebp",
            "latest_event_status": "fixed",
            "latest_event_timestamp": "2023-09-12T14:44:35Z"
          }
        ]
      }
    },
    {
      "package": {
        "ecosystem": "Wolfi",
        "name": "libwebp",
        "purl": "pkg:apk/wolfi/libwebp?arch=x86_64"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1-r2"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "components": [
          {
            "component_name": "libwebp",
            "component_version": "",
            "component_type": "apk",
            "component_location": "/.PKGINFO",
            "component_purl": "pkg:apk/libwebp",
            "latest_event_status": "fixed",
            "latest_event_timestamp": "2023-09-12T14:44:35Z"
          }
        ]
      }
    }
  ]
}