pwned.coffeeOrder ticket · today's special · 27 Oct 2026

🔥 On the fly · exploited in the wildScalding · 540°CcriticalHalf-poured · some lines fixed

Mitsubishi Electric: code exec, auth bypass

Chrome

Mitsubishi Electric products vulnerable to code execution, authentication bypass, and info disclosure.

Do this now

It is being exploited: install the update for your version: Chrome → 116.0.5845.187; electron → 26.2.1; magick.net-q16-anycpu → 13.3.0 (+17 more lines in Fix it).

Fix it

Chrome

Upgrade to Chrome 116.0.5845.187

libwebp

Upgrade to libwebp 1.3.2

GENESIS

Fix not named in the CVE record: see vendor advisory

GENESIS64

Fix not named in the CVE record: see vendor advisory

ICONICS Suite

Fix not named in the CVE record: see vendor advisory

Hyper Historian

Fix not named in the CVE record: see vendor advisory

AnalytiX

Fix not named in the CVE record: see vendor advisory

MobileHMI

Fix not named in the CVE record: see vendor advisory

IoTWorX

Fix not named in the CVE record: see vendor advisory

electron npm

On 22.x?npm install electron@22.3.24
On 24.x?npm install electron@24.8.3
On 25.x?npm install electron@25.8.1
On 26.x?npm install electron@26.2.1
On 27.xNo stable fix for 27.x yet (only 27.0.0-beta.2)

Pillow pip

pip install --upgrade "Pillow>=10.0.1"

github.com/chai2010/webp go

On 0.0.x?go get github.com/chai2010/webp@v0.0.0-20250406010349-76805d5a8860
On 1.1.x?go get github.com/chai2010/webp@v1.1.2-0.20250406010349-76805d5a8860
On 1.4.x?go get github.com/chai2010/webp@v1.4.0

libwebp-sys2 cargo

cargo update -p libwebp-sys2 --precise 0.1.8

libwebp-sys cargo

cargo update -p libwebp-sys --precise 0.9.3

webp cargo

cargo update -p webp --precise 0.2.6

SkiaSharp nuget

dotnet add package SkiaSharp --version 2.88.6

magick.net-q16-anycpu nuget

dotnet add package magick.net-q16-anycpu --version 13.3.0

magick.net-q16-hdri-anycpu nuget

dotnet add package magick.net-q16-hdri-anycpu --version 13.3.0

magick.net-q16-x64 nuget

dotnet add package magick.net-q16-x64 --version 13.3.0

magick.net-q8-anycpu nuget

dotnet add package magick.net-q8-anycpu --version 13.3.0

magick.net-q8-openmp-x64 nuget

dotnet add package magick.net-q8-openmp-x64 --version 13.3.0

magick.net-q8-x64 nuget

dotnet add package magick.net-q8-x64 --version 13.3.0

Fixed for Rust (libwebp-sys2), Rust (libwebp-sys), npm (electron), .NET (SkiaSharp), Python (Pillow), Rust (webp), .NET (magick.net-q16-anycpu), .NET (magick.net-q16-hdri-anycpu), .NET (magick.net-q16-x64), .NET (magick.net-q8-anycpu), .NET (magick.net-q8-openmp-x64), .NET (magick.net-q8-x64), Go (github.com/chai2010/webp), Chrome and libwebp; still cooking for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX.

Also affects (downstream advisories): bandisoft honeyview. Check those vendors' own fixes.

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 16:17 UTC
Fixed in: libwebp-sys2 0.1.8
libwebp-sys 0.9.3
electron 27.0.0-beta.2
electron 26.2.1
electron 25.8.1
electron 24.8.3
electron 22.3.24
SkiaSharp 2.88.6
Pillow 10.0.1
webp 0.2.6
magick.net-q16-anycpu 13.3.0
magick.net-q16-hdri-anycpu 13.3.0
magick.net-q16-x64 13.3.0
magick.net-q8-anycpu 13.3.0
magick.net-q8-openmp-x64 13.3.0
magick.net-q8-x64 13.3.0
github.com/chai2010/webp 1.4.0
github.com/chai2010/webp 1.1.2-0.20250406010349-76805d5a8860
github.com/chai2010/webp 0.0.0-20250406010349-76805d5a8860
Chrome 116.0.5845.187
libwebp 1.3.2
Identifiers: CVE-2023-4863
CVE-2026-16436
CVE-2026-16437
CVE-2026-16438
CVSS: 9.4
Source: news
On the menu as: Chrome
npm packages
PyPI packages
Go

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Mitsubishi Electric: code exec, auth bypass
Severity: critical, exploited in the wild. Patch status: partial fix.
Affected: Chrome
Fixed in: libwebp-sys2 0.1.8, libwebp-sys 0.9.3, electron 27.0.0-beta.2, electron 26.2.1, electron 25.8.1, electron 24.8.3, electron 22.3.24, SkiaSharp 2.88.6, Pillow 10.0.1, webp 0.2.6, magick.net-q16-anycpu 13.3.0, magick.net-q16-hdri-anycpu 13.3.0, magick.net-q16-x64 13.3.0, magick.net-q8-anycpu 13.3.0, magick.net-q8-openmp-x64 13.3.0, magick.net-q8-x64 13.3.0, github.com/chai2010/webp 1.4.0, github.com/chai2010/webp 1.1.2-0.20250406010349-76805d5a8860, github.com/chai2010/webp 0.0.0-20250406010349-76805d5a8860, Chrome 116.0.5845.187, libwebp 1.3.2
Ids: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, CVE-2026-16438

Mitsubishi Electric products vulnerable to code execution, authentication bypass, and info disclosure.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `libwebp-sys2`, `libwebp-sys`, `electron`, `SkiaSharp`, `Pillow`, `webp`, `magick.net-q16-anycpu`, `magick.net-q16-hdri-anycpu`, `magick.net-q16-x64`, `magick.net-q8-anycpu`, `magick.net-q8-openmp-x64`, `magick.net-q8-x64`, `github.com/chai2010/webp`. For each hit, compare the installed version with the fix on the same major line: libwebp-sys2 0.1.8, libwebp-sys 0.9.3, electron 27.0.0-beta.2, electron 26.2.1, electron 25.8.1, electron 24.8.3, electron 22.3.24, SkiaSharp 2.88.6, Pillow 10.0.1, webp 0.2.6, magick.net-q16-anycpu 13.3.0, magick.net-q16-hdri-anycpu 13.3.0, magick.net-q16-x64 13.3.0, magick.net-q8-anycpu 13.3.0, magick.net-q8-openmp-x64 13.3.0, magick.net-q8-x64 13.3.0, github.com/chai2010/webp 1.4.0, github.com/chai2010/webp 1.1.2-0.20250406010349-76805d5a8860, github.com/chai2010/webp 0.0.0-20250406010349-76805d5a8860, Chrome 116.0.5845.187, libwebp 1.3.2. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Fix by release line: libwebp-sys2: older than 0.1.8 → 0.1.8. libwebp-sys: older than 0.9.3 → 0.9.3. electron: 27.0.x has no stable fix (only 27.0.0-beta.2); 26.0.x → 26.2.1; 25.0.x → 25.8.1; 24.0.x → 24.8.3; 22.0.x → 22.3.24. SkiaSharp: >= 2.0.0 < 2.88.6 → 2.88.6. Pillow: older than 10.0.1 → 10.0.1. webp: older than 0.2.6 → 0.2.6. magick.net-q16-anycpu: older than 13.3.0 → 13.3.0. magick.net-q16-hdri-anycpu: older than 13.3.0 → 13.3.0. magick.net-q16-x64: older than 13.3.0 → 13.3.0. magick.net-q8-anycpu: older than 13.3.0 → 13.3.0. magick.net-q8-openmp-x64: older than 13.3.0 → 13.3.0. magick.net-q8-x64: older than 13.3.0 → 13.3.0. github.com/chai2010/webp: >= 1.1.2 < 1.4.0 → 1.4.0; 1.1.x → 1.1.2-0.20250406010349-76805d5a8860; 0.0.x → 0.0.0-20250406010349-76805d5a8860. Chrome: 116.0.x → 116.0.5845.187. libwebp: 1.3.x → 1.3.2. GENESIS; GENESIS64; ICONICS Suite; Hyper Historian; AnalytiX; MobileHMI; IoTWorX: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| libwebp-sys2 older than 0.1.8 | fixed | 0.1.8 | — |
| libwebp-sys older than 0.9.3 | fixed | 0.9.3 | — |
| electron 27.0.x | No stable fix (only rc) | 27.0.0-beta.2 is a prerelease | restrict network access to it |
| electron 26.0.x | fixed | 26.2.1 | — |
| electron 25.0.x | fixed | 25.8.1 | — |
| electron 24.0.x | fixed | 24.8.3 | — |
| electron 22.0.x | fixed | 22.3.24 | — |
| SkiaSharp >= 2.0.0 < 2.88.6 | fixed | 2.88.6 | — |
| Pillow older than 10.0.1 | fixed | 10.0.1 | — |
| webp older than 0.2.6 | fixed | 0.2.6 | — |
| magick.net-q16-anycpu older than 13.3.0 | fixed | 13.3.0 | — |
| magick.net-q16-hdri-anycpu older than 13.3.0 | fixed | 13.3.0 | — |
| magick.net-q16-x64 older than 13.3.0 | fixed | 13.3.0 | — |
| magick.net-q8-anycpu older than 13.3.0 | fixed | 13.3.0 | — |
| magick.net-q8-openmp-x64 older than 13.3.0 | fixed | 13.3.0 | — |
| magick.net-q8-x64 older than 13.3.0 | fixed | 13.3.0 | — |
| github.com/chai2010/webp >= 1.1.2 < 1.4.0 | fixed | 1.4.0 | — |
| github.com/chai2010/webp 1.1.x | fixed | 1.1.2-0.20250406010349-76805d5a8860 | — |
| github.com/chai2010/webp 0.0.x | fixed | 0.0.0-20250406010349-76805d5a8860 | — |
| Chrome 116.0.x | fixed | 116.0.5845.187 | — |
| libwebp 1.3.x | fixed | 1.3.2 | — |
| GENESIS | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| GENESIS64 | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| ICONICS Suite | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| Hyper Historian | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| AnalytiX | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| MobileHMI | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |
| IoTWorX | not named in the CVE record | check the vendor advisory: https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2023-4863") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
https://pwned.coffee/i/mitsubishi-electric-code-exec-auth-bypass

Timeline

27 Oct 2026, 16:17 UTC
Fix status: unknown → partial fix.
27 Oct 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2023-4863 added to CISA KEV on 2023-09-13, federal deadline 2023-10-04.” source
Fix by release line: Product Affected Fixed in Source
libwebp-sys2 (cargo) < 0.1.8 0.1.8 GitHub advisory checked 27 Oct
libwebp-sys (cargo) < 0.9.3 0.9.3 GitHub advisory checked 27 Oct
electron (npm) >= 27.0.0-beta.1, < 27.0.0-beta.2 27.0.0-beta.2 GitHub advisory checked 27 Oct
electron (npm) >= 26.0.0, < 26.2.1 26.2.1 GitHub advisory checked 27 Oct
electron (npm) >= 25.0.0, < 25.8.1 25.8.1 GitHub advisory checked 27 Oct
electron (npm) >= 24.0.0, < 24.8.3 24.8.3 GitHub advisory checked 27 Oct
electron (npm) >= 22.0.0, < 22.3.24 22.3.24 GitHub advisory checked 27 Oct
SkiaSharp (nuget) >= 2.0.0, < 2.88.6 2.88.6 GitHub advisory checked 27 Oct
Pillow (pip) < 10.0.1 10.0.1 GitHub advisory checked 27 Oct
webp (cargo) < 0.2.6 0.2.6 GitHub advisory checked 27 Oct
magick.net-q16-anycpu (nuget) < 13.3.0 13.3.0 GitHub advisory checked 27 Oct
magick.net-q16-hdri-anycpu (nuget) < 13.3.0 13.3.0 GitHub advisory checked 27 Oct
The CVE record names no fix for 7 lines; the vendor’s advisory may: mitsubishielectric.com
Score: CVSS 9.4 (critical). CVSS 4.0 9.4 (CNA Mitsubishi) for CVE-2026-16438
Last checked: 27 Oct 2026, 16:17 UTC

Product	Affected	Fixed in	Source
libwebp-sys2 (cargo)	< 0.1.8	0.1.8	GitHub advisory checked 27 Oct
libwebp-sys (cargo)	< 0.9.3	0.9.3	GitHub advisory checked 27 Oct
electron (npm)	>= 27.0.0-beta.1, < 27.0.0-beta.2	27.0.0-beta.2	GitHub advisory checked 27 Oct
electron (npm)	>= 26.0.0, < 26.2.1	26.2.1	GitHub advisory checked 27 Oct
electron (npm)	>= 25.0.0, < 25.8.1	25.8.1	GitHub advisory checked 27 Oct
electron (npm)	>= 24.0.0, < 24.8.3	24.8.3	GitHub advisory checked 27 Oct
electron (npm)	>= 22.0.0, < 22.3.24	22.3.24	GitHub advisory checked 27 Oct
SkiaSharp (nuget)	>= 2.0.0, < 2.88.6	2.88.6	GitHub advisory checked 27 Oct
Pillow (pip)	< 10.0.1	10.0.1	GitHub advisory checked 27 Oct
webp (cargo)	< 0.2.6	0.2.6	GitHub advisory checked 27 Oct
magick.net-q16-anycpu (nuget)	< 13.3.0	13.3.0	GitHub advisory checked 27 Oct
magick.net-q16-hdri-anycpu (nuget)	< 13.3.0	13.3.0	GitHub advisory checked 27 Oct

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

cisa.gov: Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee