CVE-2023-5217
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Google Chromium libvpx Heap Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 49% (percentile: 99) as of 2 November 2026
- CWE
- CWE-787
Affected products
webmproject: libvpx; microsoft: edge; microsoft: edge chromium; mozilla: firefox; mozilla: thunderbird; fedoraproject: fedora; debian: debian linux; apple: ipados; apple: iphone os; google: chrome; redhat: enterprise linux
References
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop… Vendor Advisory
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop… Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing ListPatchThird Party Advisory
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef… Patch
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b… Patch
- http://www.openwall.com/lists/oss-security/2023/09/28/5 Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2023/09/28/6 Mailing ListPatchThird Party Advisory
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef… Patch
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b… Patch