VM Analysis

CVE-2023-4863

A heap buffer overflow in libwebp can be triggered by crafted image data, with broad downstream impact due...

Illustrative, frozen demo data. Scores and catalog status are not current intelligence.

Priority assessment

Accelerated Remediation

Confirm the affected product is deployed and prioritize a short remediation window.

CVSS 8.8 EPSS 73.20% Not listed

Available severity or exploitation probability signals justify expedited remediation.

Global priority evidence

  • High exploitation probability: EPSS
  • Vendor guidance unavailable for this CVE
ApplicabilityNo vendor remediation reference was identified in the NVD record.

Vulnerability overview

Core NVD metadata for the selected vulnerability.

DescriptionA heap buffer overflow in libwebp can be triggered by crafted image data, with broad downstream impact due to widespread library reuse.

Dates and weaknesses

PublishedSep 12, 2023
Last ModifiedOct 2, 2023
  • CWE-122: Heap-based Buffer Overflow

Vendor remediation

The strongest available remediation source is shown below. Confirm the installed OS, product, and version before treating it as applicable.

No primary vendor remediation source was identified. Review the supporting references and verify the affected product with the vendor.

CVSS · Technical severity

Base scoring from the preferred metric available in NVD.

8.8

HIGHv3.1
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability Score2.8
Impact Score5.9

EPSS · Exploitation probability

FIRST exploitation probability enrichment.

73.20%

Available
EPSS Score73.20%
Percentile98.20%
Score DateFeb 28, 2026

KEV · Known exploitation

CISA known exploited vulnerability catalog status.

Not listed
VendorNot available
ProductNot available
Vulnerability NameNot available
Date AddedNot available
Due DateNot available
Required ActionNot available
NotesNot available

Sources and freshness

NVDok
EPSSok
KEVnot_listed
NVD last modifiedNot available
EPSS dateNot available
KEV date addedNot available
Vendor verifiedNot available

Supporting sources (3)

Vendor remediation supporting sources (0)
  • No vendor remediation supporting sources were identified.
Check your asset

Filter vendor guidance using analyst-provided context. This does not prove the asset is vulnerable and is not persisted.

Handoff summary

Copy this summary into change management or an analyst handoff. It does not claim confirmed asset exposure.