# WebP Codec's heap buffer overflow vulnerability (CVE-2023-4863)

**URL:** <https://forum.ansible.com/t/webp-codecs-heap-buffer-overflow-vulnerability-cve-2023-4863/916>\
**Category:** Social Space\
**Tags:** cve\
**Created:** [September 19, 2023, 6:35am UTC](https://forum.ansible.com/t/webp-codecs-heap-buffer-overflow-vulnerability-cve-2023-4863/916 "2023-09-19T06:35:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Santheerdas](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/santheerdas/32/688_2.png) [@Santheerdas](https://forum.ansible.com/u/Santheerdas)\
**Post date:** [September 19, 2023, 6:35am UTC](https://forum.ansible.com/t/webp-codecs-heap-buffer-overflow-vulnerability-cve-2023-4863/916/1 "2023-09-19T06:35:26Z")

</div>

Hi Team,  
Has anyone discovered that WebP Codec’s heap buffer overflow vulnerability (CVE-2023-4863) in the Ansible version?

---

<div class="post-metadata">

**Author:** ![Leo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/leo/32/23_2.png) [@Leo](https://forum.ansible.com/u/Leo)\
**Post date:** [September 19, 2023, 2:27pm UTC](https://forum.ansible.com/t/webp-codecs-heap-buffer-overflow-vulnerability-cve-2023-4863/916/2 "2023-09-19T14:27:44Z")

</div>

Hi @Santheerdas , that [CVE-2023-4863](https://nvd.nist.gov/vuln/detail/CVE-2023-4863) seems to be affecting browsers.

The Ansible projects are not affected by this.

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [September 20, 2023, 6:13am UTC](https://forum.ansible.com/t/webp-codecs-heap-buffer-overflow-vulnerability-cve-2023-4863/916/3 "2023-09-20T06:13:06Z")

</div>

It does not only affect browsers, but every program that includes/uses libwebp ([more info](https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/)). Ansible itself does not use this library directly. The only way Ansible could in theory be affected is that a) this library is used by Python itself, b) you installed some other Python library that contains a compiled version of libwebp, or c) you are using an Ansible collection that includes binary content that includes the code from libwebp. A potential Python library using libwebp could be [Pillow](https://pypi.org/project/Pillow/) ([it does use libwebp](https://github.com/python-pillow/Pillow/pull/7395)). So if you installed Pillow for whatever reason (I’m not aware of any Ansible content using it), you might want to look at that one.

In any case, Ansible directly should not be affected, but you want to look at the Python libraries you installed and watch out for updates for these.