GHSA-j646-gj5p-p45g: 
C# vulnerability analysis and mitigation

A critical heap buffer overflow vulnerability (GHSA-j646-gj5p-p45g) was discovered in CefSharp's WebP implementation. The vulnerability affects CefSharp.Common and CefSharp.Common.NETCore packages versions below 116.0.230. This security issue was identified in Google Chrome prior to version 116.0.5845.187, and Google confirmed that an exploit exists in the wild (GitHub Advisory).

The vulnerability is a heap buffer overflow in WebP processing that allows remote attackers to perform out-of-bounds memory writes through specially crafted HTML pages. The issue has been assigned a Critical severity rating. Additionally, there is a related vulnerability (CVE-2023-5217) fixed in Chromium 117.0.5938.132 that affects the WebCodecs API encoder (GitHub Advisory).

The vulnerability enables remote attackers to perform out-of-bounds memory writes, which could potentially lead to code execution or system compromise. Given that Google has confirmed exploits existing in the wild, the risk of exploitation is significant (GitHub Advisory).

The vulnerability has been patched in CefSharp version 116.0.230. For the related CVE-2023-5217 vulnerability, users of older versions can implement a workaround by disabling the WebCodecs API using the command-line flag --disable-blink-features=WebCodecs (GitHub Release).