CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
02 Description
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
03 Exploitation and scoring
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2023-10-02. Federal remediation due 2023-10-23.
- SSVC decision
- ExploitationactiveCISA reports credible evidence of active exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 49.01% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 98.7% of scored records. A rank, not a probability.
- NVD base score
- 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVD analysis status
- Analyzed. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2023-09-28 15:23Z3 YR AGO
- Last updated
- 2025-10-21 23:05Z1 YR AGO
- Reserved
- 2023-09-27
- Assigning CNA
- Chrome
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- Data version
- 5.1
- Document digest
- 581a852ef645e79a183dcfda6ed9e05e5346f1f9d52787b85d5be55a2c2c2a44
05 Affected products
06 References
- chromereleases.googleblog.comhttps://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html
- crbug.comhttps://crbug.com/1486441
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/28/5
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/28/6
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/7
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/9
- www.mozilla.orghttps://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
- security-tracker.debian.orghttps://security-tracker.debian.org/tracker/CVE-2023-5217
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2241191
- stackdiary.comhttps://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
- www.openwall.comhttps://www.openwall.com/lists/oss-security/2023/09/28/5
- pastebin.comhttps://pastebin.com/TdkC4pDv
- github.comhttps://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
- github.comhttps://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
- github.comhttps://github.com/webmproject/libvpx/tags
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/11
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/12
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/29/14
- www.debian.orghttps://www.debian.org/security/2023/dsa-5510
- www.debian.orghttps://www.debian.org/security/2023/dsa-5509
- www.debian.orghttps://www.debian.org/security/2023/dsa-5508
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/30/1
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
- twitter.comhttps://twitter.com/maddiestone/status/1707163313711497266
- arstechnica.comhttps://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
- github.comhttps://github.com/webmproject/libvpx/releases/tag/v1.13.1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/30/3
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/30/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/30/4
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/09/30/5
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/10/01/2
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/10/01/1
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/10/01/5
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/10/02/6
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/10/03/11
- security.gentoo.orghttps://security.gentoo.org/glsa/202310-04
- support.apple.comhttps://support.apple.com/kb/HT213961
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/
- seclists.orghttp://seclists.org/fulldisclosure/2023/Oct/12
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
- support.apple.comhttps://support.apple.com/kb/HT213972
- seclists.orghttp://seclists.org/fulldisclosure/2023/Oct/16
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/
- security.gentoo.orghttps://security.gentoo.org/glsa/202401-34
- www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217
07 Fixed in
AlmaLinux 8
- libvpx Fixed in 1.7.0-10.el8_8.alma.1
- libvpx-devel Fixed in 1.7.0-10.el8_8.alma.1
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
AlmaLinux 9
- firefox Fixed in 115.3.1-1.el9_2.alma.1
- firefox-x11 Fixed in 115.3.1-1.el9_2.alma.1
- libvpx Fixed in 1.9.0-7.el9_2.alma.1
- libvpx-devel Fixed in 1.9.0-7.el9_2.alma.1
- thunderbird Fixed in 115.3.1-1.el9_2.alma
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- libvpx Fixed in 1.7.0-10.el8_8.alma.1
- libvpx-devel Fixed in 1.7.0-10.el8_8.alma.1
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 9
- firefox Fixed in 115.3.1-1.el9_2.alma.1
- firefox-x11 Fixed in 115.3.1-1.el9_2.alma.1
- libvpx Fixed in 1.9.0-7.el9_2.alma.1
- libvpx-devel Fixed in 1.9.0-7.el9_2.alma.1
- thunderbird Fixed in 115.3.1-1.el9_2.alma
Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- chromium Fixed in 117.0.5938.132-1~deb12u1
- firefox-esr No fix yet
- libvpx Fixed in 1.12.0-1+deb12u1
- thunderbird Fixed in 1:115.3.1-1~deb12u1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- chromium Fixed in 117.0.5938.132-1
- firefox-esr No fix yet
- libvpx Fixed in 1.12.0-1.1
- thunderbird Fixed in 1:115.3.1-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- chromium Fixed in 117.0.5938.132-1
- firefox-esr No fix yet
- libvpx Fixed in 1.12.0-1.1
- thunderbird Fixed in 1:115.3.1-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- mozjs38 No fix yet
- mozjs52 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- firefox Fixed in 118.0.1+build1-0ubuntu0.20.04.1
- libvpx Fixed in 1.8.2-1ubuntu0.2
- mozjs52 No fix yet
- mozjs68 No fix yet
- thunderbird Fixed in 1:115.3.1+build1-0ubuntu0.20.04.1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- libvpx Fixed in 1.11.0-2ubuntu2.2
- mozjs102 No fix yet
- mozjs78 No fix yet
- mozjs91 No fix yet
- thunderbird Fixed in 1:115.3.1+build1-0ubuntu0.22.04.2
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- mozjs102 No fix yet
- thunderbird Fixed in 1:115.3.1+build1-0ubuntu1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 14.04 LTS
- libvpx Fixed in 1.3.0-2ubuntu0.1~esm3Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- libvpx Fixed in 1.5.0-2ubuntu1.1+esm2Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- libvpx Fixed in 1.7.0-3ubuntu0.18.04.1+esm1Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.