Field reference for the per-CVE enrichment records. Consumers can fetch kevrichment/data/index.json to filter, then individual kevrichment/data/cves/<CVE-ID>.json records.
Sample record CVE-2023-4863
{
"schema_version": "1.0",
"cve_id": "CVE-2023-4863",
"last_researched": "2026-09-11T03:55:03Z",
"kev_date_added": "2023-09-13",
"kev_vendor_project": "Google",
"kev_product": "Chromium WebP",
"kev_short_description": "Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.",
"kev_required_action": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"kev_due_date": "2023-10-04",
"kev_vulnerability_name": "Google Chromium WebP Heap-Based Buffer Overflow Vulnerability",
"nvd_description": "Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)",
"cwe": [
"CWE-787"
],
"cvss_v3_base_score": 8.8,
"cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cpe_affected": [
"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"cpe:2.3:a:microsoft:teams:*:*:*:*:macos:*:*",
"cpe:2.3:a:microsoft:teams:*:*:*:*:desktop:*:*:*",
"cpe:2.3:a:microsoft:webp_image_extension:*:*:*:*:*:*:*:*",
"cpe:2.3:a:webmproject:libwebp:*:*:*:*:*:*:*:*",
"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
"cpe:2.3:a:bentley:seequent_leapfrog:*:*:*:*:*:*:*:*",
"cpe:2.3:a:bandisoft:honeyview:*:*:*:*:*:*:*:*"
],
"vulnrichment": {
"automatable": "no",
"technical_impact": "total",
"exploitation_status": "active"
},
"bod_26_04": {
"timeline_if_publicly_exposed": "3_days_forensic_triage",
"timeline_if_not_publicly_exposed": "14_days",
"three_day_qualifying": true,
"requires_forensic_analysis_if_public": true,
"requires_forensic_analysis_if_not_public": false
},
"kevrichment_research": {
"vulnerable_component": "libwebp BuildHuffmanTable function (src/dec/vp8l_dec.c) - the kTableSize array only accounts for 8-bit first-level table lookups; when BuildHuffmanTable() fills second-level tables via ReplicateValue() it writes out-of-bounds on the heap for Huffman codes longer than 8 bits (up to 15 bits MAX_ALLOWED_CODE_LENGTH)",
"vulnerable_component_enabled_by_default": "yes",
"preconditions_for_exploit": "Remote attacker must deliver a specially crafted WebP lossless image to the target via a webpage, HTML email, or direct image load. User interaction is required (visiting a webpage or viewing the image). The target application must use a vulnerable version of libwebp (0.5.0 through 1.3.1) or Chromium prior to 116.0.5845.187. No special network position is needed; the attack is remote over the internet. The WebP decoder is enabled by default in all major browsers and many image-processing applications.",
"public_poc_exists": "yes",
"public_poc_urls": [
"https://github.com/mistymntncop/CVE-2023-4863",
"https://github.com/LiveOverflow/webp-CVE-2023-4863"
],
"vendor_advisory_url": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html",
"exploit_complexity_notes": "CVSS attack complexity: LOW | CRITICAL (CVSS 8.8; Chromium severity Critical). Exploited in the wild as a zero-day; NSO Group chained the same libwebp flaw as CVE-2023-41064 in the BLASTPASS iMessage exploit against iOS. The in-the-wild primitive writes the 32-bit value 0x270007 0x58 bytes past the end of a 0x3000-byte Huffman table allocation (Project Zero, March 2025). The public PoCs (mistymntncop/CVE-2023-4863 craft.c, LiveOverflow/webp-CVE-2023-4863) only trigger the heap overflow/crash and are not weaponized - the mistymntncop README explicitly states it is 'NOT an exploit'. Full RCE is nontrivial. Affects every product embedding libwebp 0.5.0-1.3.1 (Chrome, Firefox, Edge, Safari, Telegram, Signal, Microsoft Teams, etc.).",
"kevrichment_summary": "CVE-2023-4863 is a heap buffer overflow in the libwebp library's BuildHuffmanTable function (src/dec/vp8l_dec.c). The kTableSize array only reserves space for 8-bit Huffman table lookups, but libwebp allows codes up to 15 bits. When BuildHuffmanTable() attempts to fill second-level sub-tables via ReplicateValue(), it writes past the allocated buffer on the heap. This was exploited in the wild as a zero-day (discovered by Citizen Lab, tied to the BLASTPASS iMessage exploit chain targeting iOS devices via CVE-2023-41064). The vulnerability was patched in Chrome 116.0.5845.187 and libwebp 1.3.2. Multiple public PoCs exist that trigger the crash (DoS), though full RCE exploitation is nontrivial. The flaw affects virtually all software that renders WebP images, including Chrome, Firefox, Edge, Safari, Telegram, Signal, Microsoft Teams, and many others.",
"delivery_mechanism": "Specially crafted lossless WebP (RIFF/WEBP container, VP8L chunk) with malformed Huffman code lengths delivered via an HTML page, email attachment, or direct image URL; decoding overflows the huffman_tables buffer in libwebp's BuildHuffmanTable().",
"hunting_hypothesis": "Hunt for `VP8L` lossless WebP payloads whose malformed Huffman code lengths overflow the decoder table, surfacing as `BuildHuffmanTable` crashes in browser/renderer telemetry and `RIFF`/`WEBP` uploads on proxy or WAF file-inspection logs.",
"preconditions_source": "agent",
"hunting_hypothesis_source": "agent"
},
"research_meta": {
"timestamp": "2026-09-11T03:55:03Z",
"wall_time_seconds": 1.5,
"tokens_used": null,
"searches_performed": 6,
"sources_consulted": [
"https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4863",
"https://blog.isosceles.com/the-webp-0day/",
"https://www.huntress.com/blog/critical-vulnerability-webp-heap-buffer-overflow-cve-2023-4863",
"https://www.tarlogic.com/blog/cve-2023-4863/",
"https://www.veracode.com/blog/resolving-webp-zero-day-vulnerability-cve-2023-4863/",
"https://blog.cloudflare.com/uncovering-the-hidden-webp-vulnerability-cve-2023-4863/",
"https://github.com/mistymntncop/CVE-2023-4863",
"https://github.com/LiveOverflow/webp-CVE-2023-4863",
"https://access.redhat.com/security/cve/cve-2023-4863",
"https://www.sentinelone.com/vulnerability-database/cve-2023-4863/"
]
},
"qc_notes": [],
"cve_published": "2023-09-12T15:15:24.327",
"kev_seq": 720,
"kev_catalog_count": 1713,
"epss": 0.99979,
"epss_percentile": 0.9998,
"epss_date": "2026-10-13",
"epss_prev": 0.99979,
"epss_delta_7d": 0.0
}