Microsoft WebP Image Extension vulnerabilities

3 CVEs affecting Microsoft WebP Image Extension, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70351, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability, published 2023-09-12. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-09-13. EPSS: 100% chance of exploitation in the next 30 days. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium…
• CVE-2020-17102, published 2020-11-11. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. WebP Image Extensions Information Disclosure Vulnerability
• CVE-2026-70351, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.