How severe is GHSA-j646-gj5p-p45g?

No CVSS score has been assigned to GHSA-j646-gj5p-p45g yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-j646-gj5p-p45g?

GHSA-j646-gj5p-p45g affects the following packages: CefSharp.Common (NuGet), CefSharp.Common.NETCore (NuGet). Ecosystems affected: NuGet.

How do I fix GHSA-j646-gj5p-p45g?

Update CefSharp.Common to 116.0.230 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j646-gj5p-p45g is resolved across your whole dependency graph.

How do I detect GHSA-j646-gj5p-p45g in my NuGet dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for CefSharp.Common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-j646-gj5p-p45g if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is GHSA-j646-gj5p-p45g actively exploited in the wild?

No public exploit code has been indexed for GHSA-j646-gj5p-p45g yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-j646-gj5p-p45g published, and has it been updated?

GHSA-j646-gj5p-p45g was published on September 21, 2023 and was last updated on December 7, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

.NET NuGet

Not in CISA KEV

CefSharp affected by heap buffer overflow in WebPGHSA-j646-gj5p-p45g

Fix: cefsharp/CefSharp@f2890ba

GHSA-j646-gj5p-p45g is a remote code execution vulnerability in CefSharp.Common. A fix is available for CefSharp.Common — see the affected versions and patch details below.

Published

Sep 21, 2023

Updated

Dec 7, 2024

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Dec 7, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

.NETCefSharp.Common.NETCefSharp.Common.NETCore

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Google is aware that an exploit for CVE-2023-4863 exists in the wild.

Description

Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

References

Updated

There is another related security vulnerability.

There's another related CVE (CVE-2023-5217) that is fixed in Chromium 117.0.5938.132. This one is triggered by WebCodecs API encoder usage, so a workaround for older versions is to disable the WebCodecs API (--disable-blink-features=WebCodecs).

As per https://magpcss.org/ceforum/viewtopic.php?f=6&t=19551#p54150

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
.NETNuGet	`CefSharp.Common`	all versions	116.0.230`dotnet add package CefSharp.Common --version 116.0.230`
.NETNuGet	`CefSharp.Common.NETCore`	all versions	116.0.230`dotnet add package CefSharp.Common.NETCore --version 116.0.230`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for CefSharp.Common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update CefSharp.Common to 116.0.230 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j646-gj5p-p45g is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

**Google is aware that an exploit for [CVE-2023-4863](https://www.cve.org/CVERecord?id=CVE-2023-4863) exists in the wild.** ### Description Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) ### References - https://www.cve.org/CVERecord?id=CVE-2023-4863 - https://nvd.nist.gov/vuln/detail/CVE-2023-4863 - https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability --- **Updated** There is

O3 Security · Impact-Aware SCA

Is GHSA-j646-gj5p-p45g in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works

CefSharp affected by heap buffer overflow in WebPGHSA-j646-gj5p-p45g

Real-World Exposure

Description

Description

References

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

Frequently Asked Questions

Is GHSA-j646-gj5p-p45g in your dependencies?