Full field reference for the kevrichment CVE enrichment schema. Version 1.0.
Sample CVE Record (click to expand)
{
"schema_version": "1.0",
"cve_id": "CVE-2023-4863",
"last_researched": "2026-06-16T14:02:00Z",
"kev_date_added": "2023-09-13",
"kev_vendor_project": "Google",
"kev_product": "Chromium WebP",
"kev_short_description": "Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.",
"kev_required_action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"kev_due_date": "2023-10-04",
"kev_vulnerability_name": "Google Chromium WebP Heap-Based Buffer Overflow Vulnerability",
"nvd_description": "Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)",
"cwe": [
"CWE-787",
"CWE-787"
],
"cvss_v3_base_score": 8.8,
"cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpe_affected": [
"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:teams:*:*:*:*:macos:*:*",
"cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*",
"cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*",
"cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*",
"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
"cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*",
"cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*"
],
"vulnrichment": {
"automatable": "no",
"technical_impact": "total",
"exploitation_status": "active"
},
"bod_26_04": {
"timeline_if_publicly_exposed": "3_days_forensic_triage",
"timeline_if_not_publicly_exposed": "14_days",
"three_day_qualifying": true,
"requires_forensic_analysis_if_public": true,
"requires_forensic_analysis_if_not_public": false
},
"kevrichment_research": {
"vulnerable_component": "libwebp BuildHuffmanTable function (src/dec/vp8l_dec.c) - the kTableSize array only accounts for 8-bit first-level table lookups; when BuildHuffmanTable() fills second-level tables via ReplicateValue() it writes out-of-bounds on the heap for Huffman codes longer than 8 bits (up to 15 bits MAX_ALLOWED_CODE_LENGTH)",
"vulnerable_component_enabled_by_default": "yes",
"preconditions_for_exploit": "Remote attacker must deliver a specially crafted WebP lossless image to the target via a webpage, HTML email, or direct image load. User interaction is required (visiting a webpage or viewing the image). The target application must use a vulnerable version of libwebp (0.5.0 through 1.3.1) or Chromium prior to 116.0.5845.187. No special network position is needed; the attack is remote over the internet. The WebP decoder is enabled by default in all major browsers and many image-processing applications.",
"public_poc_exists": "yes",
"public_poc_urls": [
"https://github.com/mistymntncop/CVE-2023-4863",
"https://github.com/LiveOverflow/webp-CVE-2023-4863"
],
"vendor_advisory_url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html",
"exploit_complexity_notes": "CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.0-10.0). Actively exploited in the wild as a zero-day. Reported by Citizen Lab and Apple SEAR. The vulnerability is in libwebp and affects all applications using the library (Chrome, Firefox, Edge, Safari, Telegram, Signal, etc.).",
"kevrichment_summary": "CVE-2023-4863 is a heap buffer overflow in the libwebp library's BuildHuffmanTable function (src/dec/vp8l_dec.c). The kTableSize array only reserves space for 8-bit Huffman table lookups, but libwebp allows codes up to 15 bits. When BuildHuffmanTable() attempts to fill second-level sub-tables via ReplicateValue(), it writes past the allocated buffer on the heap. This was exploited in the wild as a zero-day (discovered by Citizen Lab, tied to the BLASTPASS iMessage exploit chain targeting iOS devices via CVE-2023-41064). The vulnerability was patched in Chrome 116.0.5845.187 and libwebp 1.3.2. Multiple public PoCs exist that trigger the crash (DoS), though full RCE exploitation is nontrivial. The flaw affects virtually all software that renders WebP images, including Chrome, Firefox, Edge, Safari, Telegram, Signal, Microsoft Teams, and many others.",
"delivery_mechanism": "Specially crafted WebP lossless image file delivered via HTML page, email attachment, or direct image URL \u2014 the image triggers an out-of-bounds heap write when decoded by libwebp's BuildHuffmanTable function",
"hunting_hypothesis": "Monitor for web-delivered content that triggers out-of-bounds memory writes in Chromium's WebP image decoder (libwebp) via specially crafted WebP images, leading to heap buffer overflow."
},
"research_meta": {
"timestamp": "2026-06-16T14:02:00Z",
"wall_time_seconds": 1.5,
"tokens_used": null,
"searches_performed": 6,
"sources_consulted": [
"https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4863",
"https://blog.isosceles.com/the-webp-0day/",
"https://www.huntress.com/blog/critical-vulnerability-webp-heap-buffer-overflow-cve-2023-4863",
"https://www.tarlogic.com/blog/cve-2023-4863/",
"https://www.veracode.com/blog/resolving-webp-zero-day-vulnerability-cve-2023-4863/",
"https://blog.cloudflare.com/uncovering-the-hidden-webp-vulnerability-cve-2023-4863/",
"https://github.com/mistymntncop/CVE-2023-4863",
"https://github.com/LiveOverflow/webp-CVE-2023-4863",
"https://access.redhat.com/security/cve/cve-2023-4863",
"https://www.sentinelone.com/vulnerability-database/cve-2023-4863/"
]
},
"qc_notes": [],
"cve_published": "2023-09-12T15:15:24.327"
}