# CVE-2023-1999: Chromium: CVE-2023-1999 Use after free in libwebp

CVE-2023-1999 is fixed in 21 products on 2 platforms, first by RHSA-2023:1787, released April 14, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-1999
- Priority: High
- CVSS: 7.5 (Medium)
- EPSS: 0.0095
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 14, 2023
- Weakness: CWE-416: Use After Free
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-1999

## Description

<p>This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2023">Google Chrome Releases</a> for more information.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Microsoft Edge Beta | 127.0.2651.8 | [Microsoft Edge Beta 127.0.2651.8](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.beta-127.0.2651.8.md) | Jun 21, 2024 |
| Windows apps | Microsoft Edge Dev | 127.0.2651.8 | [Microsoft Edge Dev 127.0.2651.8](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.dev-127.0.2651.8.md) | Jun 21, 2024 |
| Linux | firefox RHEL 8 | 0:102.10.0-1.el8_7 | [RHSA-2023:1787](https://patchblox.com/security/data/fix/linux/rhsa-2023-1787.md) | Apr 14, 2023 |
| Linux | firefox RHEL 9 | 0:102.10.0-1.el9_1 | [RHSA-2023:1786](https://patchblox.com/security/data/fix/linux/rhsa-2023-1786.md) | Apr 14, 2023 |
| Linux | firefox-esr Debian 12.15 (bookworm) | 102.10.0esr-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | firefox-esr Debian 13.5 (trixie) | 102.10.0esr-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | firefox-esr Debian 14 | 102.10.0esr-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | firefox-x11 RHEL 9 | 0:102.10.0-1.el9_1 | [RHSA-2023:1786](https://patchblox.com/security/data/fix/linux/rhsa-2023-1786.md) | Apr 14, 2023 |
| Linux | libsharpyuv0 Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [libsharpyuv0 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libsharpyuv0-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libsharpyuv0 Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [libsharpyuv0 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libsharpyuv0-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebp Debian 11.6 (bullseye) | 0.6.1-2.1+deb11u1 | [DSA-5408-1](https://patchblox.com/security/data/fix/linux/dsa-5408-1.md) | May 21, 2023 |
| Linux | libwebp Debian 12.15 (bookworm) | 1.2.4-0.2 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | libwebp Debian 13.5 (trixie) | 1.2.4-0.2 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | libwebp Debian 14 | 1.2.4-0.2 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | libwebp RHEL 8 | 0:1.0.0-8.el8_7 | [RHSA-2023:2076](https://patchblox.com/security/data/fix/linux/rhsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp RHEL 9 | 0:1.2.0-6.el9_1 | [RHSA-2023:2078](https://patchblox.com/security/data/fix/linux/rhsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp almalinux 8 | 1.0.0-8.el8_7 | [ALSA-2023:2076](https://patchblox.com/security/data/fix/linux/alsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp almalinux 9 | 1.2.0-6.el9_1 | [ALSA-2023:2078](https://patchblox.com/security/data/fix/linux/alsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp ol 8 | 0:1.0.0-8.el8_7 | [ELSA-2023-2076](https://patchblox.com/security/data/fix/linux/elsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp ol 9 | 0:1.2.0-6.el9_1 | [ELSA-2023-2078](https://patchblox.com/security/data/fix/linux/elsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp rocky 8 | 0:1.0.0-8.el8_7 | [RLSA-2023:2076](https://patchblox.com/security/data/fix/linux/rlsa-2023-2076.md) | May 25, 2023 |
| Linux | libwebp rocky 9 | 0:1.2.0-6.el9_1 | [RLSA-2023:2078](https://patchblox.com/security/data/fix/linux/rlsa-2023-2078.md) | May 5, 2023 |
| Linux | libwebp-debuginfo amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-debugsource amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-devel RHEL 8 | 0:1.0.0-8.el8_7 | [RHSA-2023:2076](https://patchblox.com/security/data/fix/linux/rhsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp-devel RHEL 9 | 0:1.2.0-6.el9_1 | [RHSA-2023:2078](https://patchblox.com/security/data/fix/linux/rhsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp-devel almalinux 8 | 1.0.0-8.el8_7 | [ALSA-2023:2076](https://patchblox.com/security/data/fix/linux/alsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp-devel almalinux 9 | 1.2.0-6.el9_1 | [ALSA-2023:2078](https://patchblox.com/security/data/fix/linux/alsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp-devel amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-devel ol 8 | 0:1.0.0-8.el8_7 | [ELSA-2023-2076](https://patchblox.com/security/data/fix/linux/elsa-2023-2076.md) | May 2, 2023 |
| Linux | libwebp-devel ol 9 | 0:1.2.0-6.el9_1 | [ELSA-2023-2078](https://patchblox.com/security/data/fix/linux/elsa-2023-2078.md) | May 2, 2023 |
| Linux | libwebp-java amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-java-debuginfo amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-tools amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp-tools-debuginfo amzn 2023 | 1.2.4-1.amzn2023.0.4 | [ALAS2023-2023-185](https://patchblox.com/security/data/fix/linux/alas2023-2023-185.md) | May 25, 2023 |
| Linux | libwebp6 Ubuntu 18.04.6 LTS (bionic) | 0.6.1-2ubuntu0.18.04.2 | [libwebp6 0.6.1-2ubuntu0.18.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libwebp6-0.6.1-2ubuntu0.18.04.2.md) | May 7, 2023 |
| Linux | libwebp6 Ubuntu 20.04 LTS (focal) | 0.6.1-2ubuntu0.20.04.2 | [libwebp6 0.6.1-2ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebp6-0.6.1-2ubuntu0.20.04.2.md) | May 7, 2023 |
| Linux | libwebp7 Ubuntu 22.04.1 LTS (jammy) | 1.2.2-2ubuntu0.22.04.1 | [libwebp7 1.2.2-2ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebp7-1.2.2-2ubuntu0.22.04.1.md) | May 7, 2023 |
| Linux | libwebp7 Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [libwebp7 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libwebp7-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebp7 Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [libwebp7 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libwebp7-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpdecoder3 Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [libwebpdecoder3 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libwebpdecoder3-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpdecoder3 Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [libwebpdecoder3 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libwebpdecoder3-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpdemux2 Ubuntu 18.04.6 LTS (bionic) | 0.6.1-2ubuntu0.18.04.2 | [libwebpdemux2 0.6.1-2ubuntu0.18.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libwebpdemux2-0.6.1-2ubuntu0.18.04.2.md) | May 7, 2023 |
| Linux | libwebpdemux2 Ubuntu 20.04 LTS (focal) | 0.6.1-2ubuntu0.20.04.2 | [libwebpdemux2 0.6.1-2ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebpdemux2-0.6.1-2ubuntu0.20.04.2.md) | May 7, 2023 |
| Linux | libwebpdemux2 Ubuntu 22.04.1 LTS (jammy) | 1.2.2-2ubuntu0.22.04.1 | [libwebpdemux2 1.2.2-2ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebpdemux2-1.2.2-2ubuntu0.22.04.1.md) | May 7, 2023 |
| Linux | libwebpdemux2 Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [libwebpdemux2 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libwebpdemux2-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpdemux2 Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [libwebpdemux2 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libwebpdemux2-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpmux3 Ubuntu 18.04.6 LTS (bionic) | 0.6.1-2ubuntu0.18.04.2 | [libwebpmux3 0.6.1-2ubuntu0.18.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libwebpmux3-0.6.1-2ubuntu0.18.04.2.md) | May 7, 2023 |
| Linux | libwebpmux3 Ubuntu 20.04 LTS (focal) | 0.6.1-2ubuntu0.20.04.2 | [libwebpmux3 0.6.1-2ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebpmux3-0.6.1-2ubuntu0.20.04.2.md) | May 7, 2023 |
| Linux | libwebpmux3 Ubuntu 22.04.1 LTS (jammy) | 1.2.2-2ubuntu0.22.04.1 | [libwebpmux3 1.2.2-2ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebpmux3-1.2.2-2ubuntu0.22.04.1.md) | May 7, 2023 |
| Linux | libwebpmux3 Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [libwebpmux3 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libwebpmux3-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | libwebpmux3 Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [libwebpmux3 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libwebpmux3-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | thunderbird Debian 12.15 (bookworm) | 1:102.10.0-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | thunderbird Debian 13.5 (trixie) | 1:102.10.0-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | thunderbird Debian 14 | 1:102.10.0-1 | [DEBIAN-CVE-2023-1999](https://patchblox.com/security/data/fix/linux/debian-cve-2023-1999.md) | Jun 20, 2023 |
| Linux | thunderbird RHEL 8 | 0:102.10.0-2.el8_7 | [RHSA-2023:1802](https://patchblox.com/security/data/fix/linux/rhsa-2023-1802.md) | Apr 17, 2023 |
| Linux | thunderbird RHEL 9 | 0:102.10.0-2.el9_1 | [RHSA-2023:1809](https://patchblox.com/security/data/fix/linux/rhsa-2023-1809.md) | Apr 17, 2023 |
| Linux | webp Ubuntu 18.04.6 LTS (bionic) | 0.6.1-2ubuntu0.18.04.2 | [webp 0.6.1-2ubuntu0.18.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-webp-0.6.1-2ubuntu0.18.04.2.md) | May 7, 2023 |
| Linux | webp Ubuntu 20.04 LTS (focal) | 0.6.1-2ubuntu0.20.04.2 | [webp 0.6.1-2ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-webp-0.6.1-2ubuntu0.20.04.2.md) | May 7, 2023 |
| Linux | webp Ubuntu 22.04.1 LTS (jammy) | 1.2.2-2ubuntu0.22.04.1 | [webp 1.2.2-2ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-webp-1.2.2-2ubuntu0.22.04.1.md) | May 7, 2023 |
| Linux | webp Ubuntu 24.10 (oracular) | 1.2.4-0.1ubuntu1 | [webp 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-webp-1.2.4-0.1ubuntu1.md) | May 8, 2023 |
| Linux | webp Ubuntu 25.04 (plucky) | 1.2.4-0.1ubuntu1 | [webp 1.2.4-0.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-webp-1.2.4-0.1ubuntu1.md) | May 8, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.