Most recent entries from all

CVE-2023-4863

Affected: Google Chrome, Google libwebp

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

GHSA-j7hp-h8jx-5ppr — libwebp: OOB write in BuildHuffmanTable

Affected: crates.io: libwebp-sys2, crates.io: libwebp-sys, npm: electron, NuGet: SkiaSharp, Go: github.com/chai2010/webp, PyPI: Pillow, crates.io: webp, NuGet: magick.net-q16-anycpu, NuGet: magick.net-q16-hdri-anycpu, NuGet: magick.net-q16-x64 and 3 more

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

PYSEC-2026-1794 — libwebp: OOB write in BuildHuffmanTable

Affected: PyPI: pillow

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.

RUSTSEC-2023-0060 — libwebp: OOB write in BuildHuffmanTable

Affected: crates.io: libwebp-sys2

[Google](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html) and [Mozilla](https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/) have released security advisories for RCE due to heap overflow in libwebp. Google warns the vulnerability has been exploited in the wild.

libwebp needs to be updated to 1.3.2 to include a patch for "OOB write in BuildHuffmanTable".