libwebp: OOB write in BuildHuffmanTable

Exploitation

Confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.

CVSS

8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

• CVE-2023-4863: 99.98% estimated exploitation activity in the next 30 days; percentile 99.98 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Published by the source

12 Sep 2023, 15:30 UTC

Last modified by the source

10 Sep 2026, 03:50 UTC

Source last checked

26 Oct 2026, 12:37 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-j7hp-h8jx-5ppr

2. Revision 2 · evidence added · 24 Oct 2026

   CISA KEV confirmed exploitation for CVE-2023-4863 (date added 2023-09-13). Customer workflow unchanged.

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-j7hp-h8jx-5ppr

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2023-4863

Advisory: libwebp: OOB write in BuildHuffmanTable
IDs: CVE-2023-4863, GHSA-j7hp-h8jx-5ppr
Record: https://patchnext.com/advisories/cve-2023-4863 (revision 3, source checked 26 Oct 2026, 12:37 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.8)
Exploitation: confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
Vendor response: Vendor fix available; fixed versions by package: skiasharp 2.88.6; magick.net-q16-hdri-anycpu 13.3.0; magick.net-q16-anycpu 13.3.0; electron 27.0.0-beta.2, 26.2.1, 25.8.1, 24.8.3, 22.3.24; libwebp-sys2 0.1.8; magick.net-q8-openmp-x64 13.3.0; magick.net-q16-x64 13.3.0; pillow 10.0.1; magick.net-q8-x64 13.3.0; webp 0.2.6; libwebp-sys 0.9.3; magick.net-q8-anycpu 13.3.0; github.com/chai2010/webp 1.4.0, 1.1.2-0.20250406010349-76805d5a8860, 0.0.0-20250406010349-76805d5a8860. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet skiasharp: affected >= 2.0.0, < 2.88.6; fixed in 2.88.6
- NuGet magick.net-q16-hdri-anycpu: affected < 13.3.0; fixed in 13.3.0
- NuGet magick.net-q16-anycpu: affected < 13.3.0; fixed in 13.3.0
- npm electron: affected >= 22.0.0, < 22.3.24; >= 24.0.0, < 24.8.3; >= 25.0.0, < 25.8.1; >= 26.0.0, < 26.2.1; >= 27.0.0-beta.1, < 27.0.0-beta.2; fixed in 26.2.1, 25.8.1, 22.3.24, 24.8.3, 27.0.0-beta.2
- crates.io libwebp-sys2: affected < 0.1.8; fixed in 0.1.8
- NuGet magick.net-q8-openmp-x64: affected < 13.3.0; fixed in 13.3.0
- NuGet magick.net-q16-x64: affected < 13.3.0; fixed in 13.3.0
- PyPI pillow: affected < 10.0.1; fixed in 10.0.1
- NuGet magick.net-q8-x64: affected < 13.3.0; fixed in 13.3.0
- crates.io webp: affected < 0.2.6; fixed in 0.2.6
- crates.io libwebp-sys: affected < 0.9.3; fixed in 0.9.3
- NuGet magick.net-q8-anycpu: affected < 13.3.0; fixed in 13.3.0
- Go github.com/chai2010/webp: affected < 0.0.0-20250406010349-76805d5a8860; >= 1.1.2, < 1.4.0; < 1.1.2-0.20250406010349-76805d5a8860; fixed in 0.0.0-20250406010349-76805d5a8860, 1.4.0, 1.1.2-0.20250406010349-76805d5a8860

## Suggested inspection (read-only)
- NuGet skiasharp: check the installed version with your package manager.
- NuGet magick.net-q16-hdri-anycpu: check the installed version with your package manager.
- NuGet magick.net-q16-anycpu: check the installed version with your package manager.
- `npm ls electron --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- crates.io libwebp-sys2: check the installed version with your package manager.
- NuGet magick.net-q8-openmp-x64: check the installed version with your package manager.
- NuGet magick.net-q16-x64: check the installed version with your package manager.
- `python -m pip show pillow`: prints the installed version. Run with the environment that serves production active.
- NuGet magick.net-q8-x64: check the installed version with your package manager.
- crates.io webp: check the installed version with your package manager.
- crates.io libwebp-sys: check the installed version with your package manager.
- NuGet magick.net-q8-anycpu: check the installed version with your package manager.
- Go github.com/chai2010/webp: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on skiasharp, magick.net-q16-hdri-anycpu, magick.net-q16-anycpu, electron, libwebp-sys2, magick.net-q8-openmp-x64, magick.net-q16-x64, pillow, magick.net-q8-x64, webp, libwebp-sys, magick.net-q8-anycpu, github.com/chai2010/webp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-j7hp-h8jx-5ppr (OSV record GHSA-j7hp-h8jx-5ppr lists affected ranges: crates.io libwebp-sys2 >=0 =0 =22.0.0 =24.0.0 =25.0.0 =26.0.0 =27.0.0-beta.1 =2.0.0 =1.1.2 =0 =0.0.0 <1.1.2-0.20250406010349-76805d5a8860 (fixed); PyPI…)
- Verified: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (CISA added CVE-2023-4863 to the Known Exploited Vulnerabilities catalog on 2023-09-13.)
- Verified: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CISA added CVE-2023-4863 to the Known Exploited Vulnerabilities catalog on 2023-09-13.)
- Verified: https://github.com/advisories/GHSA-j7hp-h8jx-5ppr (GitHub-reviewed advisory GHSA-j7hp-h8jx-5ppr lists affected ranges: crates.io libwebp-sys2 >=0 =0 =22.0.0 =24.0.0 =25.0.0 =26.0.0 =27.0.0-beta.1 =2.0.0 =0 =0 =0 =0 =0 =0…)

Commands are suggestions: review each one before running it.