CVE-2023-4863

In September 2023 Apple and Google issued emergency patches for near-identical buffer overflow vulnerabilities in libwebp (CVE-2023-41064 / CVE-2023-4863) that were used in a zero-click exploitation chain (BLASTPASS) attributed to the NSO Group. The flaw (CVSS 10) affects macOS, iOS, iPadOS, watchOS, Google Chrome and any software using vulnerable versions of libwebp, enabling out-of-bounds writes leading to DoS or potential arbitrary code execution; vendors and major Linux distributions released fixes and guidance to apply updates and mitigations such as Lockdown Mode.