GHSA-j646-gj5p-p45g
CefSharp affected by heap buffer overflow in WebP
GHSA-j646-gj5p-p45g is a vulnerability with no CVSS score yet in CefSharp.Common, published September 21, 2023. No source lists public exploit code. Fixed in CefSharp.Common 116.0.230.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
116.0.230CefSharp.Common +3 more
Description
Google is aware that an exploit for CVE-2023-4863 exists in the wild.
Description
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
References
- https://www.cve.org/CVERecord?id=CVE-2023-4863
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability
Updated
There is another related security vulnerability.
There's another related CVE (CVE-2023-5217) that is fixed in Chromium 117.0.5938.132. This one is triggered by WebCodecs API encoder usage, so a workaround for older versions is to disable the WebCodecs API (
--disable-blink-features=WebCodecs).
As per https://magpcss.org/ceforum/viewtopic.php?f=6&t=19551#p54150
Affected packages
| Package | Affected | Fixed |
|---|---|---|
CefSharp.CommonNuGet | before 116.0.230 | 116.0.230 |
CefSharp.Common.NETCoreNuGet | before 116.0.230 | 116.0.230 |
CefSharp.CommonNuGet | before 116.0.230, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.19031.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01 | 116.0.230 |
CefSharp.Common.NETCoreNuGet | before 116.0.230, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.19087.1.130-pre87.1.131-pre87.1.13288.2.40-pre88.2.9089.0.140-pre89.0.17090.5.70-pre90.6.5090.6.7091.1.16091.1.210 | 116.0.230 |
What each source reports
GitHub AdvisoriesNo score
CefSharp affected by heap buffer overflow in WebP
Google is aware that an exploit for CVE-2023-4863 exists in the wild.
Description
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
References
- https://www.cve.org/CVERecord?id=CVE-2023-4863
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability
Updated
There is another related security vulnerability.
There's another related CVE (CVE-2023-5217) that is fixed in Chromium 117.0.5938.132. This one is triggered by WebCodecs API encoder usage, so a workaround for older versions is to disable the WebCodecs API (
--disable-blink-features=WebCodecs).
As per https://magpcss.org/ceforum/viewtopic.php?f=6&t=19551#p54150
- Record
GHSA-j646-gj5p-p45g- Updated
- 2026-11-02
OSVNo score
CefSharp affected by heap buffer overflow in WebP
Google is aware that an exploit for CVE-2023-4863 exists in the wild.
Description
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
References
- https://www.cve.org/CVERecord?id=CVE-2023-4863
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability
Updated
There is another related security vulnerability.
There's another related CVE (CVE-2023-5217) that is fixed in Chromium 117.0.5938.132. This one is triggered by WebCodecs API encoder usage, so a workaround for older versions is to disable the WebCodecs API (
--disable-blink-features=WebCodecs).
As per https://magpcss.org/ceforum/viewtopic.php?f=6&t=19551#p54150
- Record
GHSA-j646-gj5p-p45g- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 148 versions. The JSON record has them.