What’s Vulnerable › Vulnerabilities

CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-10-02
• EPSS: 49.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-28 · updated 2026-06-17
• Weakness: CWE-787

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected products

• Apple iPadOS: from 17.0 before 17.0.3; 16.7 — fixed in 17.0.3
• Apple Iphone Os: from 17.0 before 17.0.3; 16.7 — fixed in 17.0.3
• Debian Linux: 10.0, 11.0, 12.0
• Fedoraproject Fedora: 37, 38, 39
• Google Chrome: before 117.0.5938.132 — fixed in 117.0.5938.132
• Microsoft Edge: 116.0.1938.98, 117.0.2045.47
• Microsoft Edge (Chromium): 116.0.5845.229, 117.0.5938.132
• Mozilla Firefox: before 115.3.1; before 118.0.1; before 118.1 — fixed in 115.3.1, 118.0.1, 118.1
• Mozilla Thunderbird: before 115.3.1 — fixed in 115.3.1
• Red Hat Enterprise Linux: 9.0
• Chromium libvpx: before 1.13.1 — fixed in 1.13.1
• Google Chrome: from 117.0.5938.132 before 117.0.5938.132 — fixed in 117.0.5938.132
• Google libvpx: from 1.13.1 before 1.13.1 — fixed in 1.13.1

How to fix

Upgrade to a fixed version: Apple iPadOS 17.0.3; Apple Iphone Os 17.0.3; Google Chrome 117.0.5938.132; Mozilla Firefox 115.3.1, 118.0.1, 118.1; Mozilla Thunderbird 115.3.1; Chromium libvpx 1.13.1; Google Chrome 117.0.5938.132; Google libvpx 1.13.1. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2023/Oct/12
• http://seclists.org/fulldisclosure/2023/Oct/16
• http://www.openwall.com/lists/oss-security/2023/09/28/5
• http://www.openwall.com/lists/oss-security/2023/09/28/6
• http://www.openwall.com/lists/oss-security/2023/09/29/1
• http://www.openwall.com/lists/oss-security/2023/09/29/11
• http://www.openwall.com/lists/oss-security/2023/09/29/12
• http://www.openwall.com/lists/oss-security/2023/09/29/14
• http://www.openwall.com/lists/oss-security/2023/09/29/2
• http://www.openwall.com/lists/oss-security/2023/09/29/7
• http://www.openwall.com/lists/oss-security/2023/09/29/9
• http://www.openwall.com/lists/oss-security/2023/09/30/1

Get alerted when CVE-2023-5217 or the next vulnerability affects your stack