{"id":"CVE-2023-5217","kind":"vulnerability","aliases":["CVE-2023-5217"],"related":[],"title":"Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a…","description":"Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"A heap buffer overflow in libvpx's VP8 encoder lets a remote attacker corrupt heap memory by getting a victim to load a crafted HTML page. Attackers are known to exploit it in the wild, and the sources say it can affect any browser that uses libvpx, including Chrome.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2023-10-02T00:00:00+00:00","products":[{"name":"Google Chromium libvpx","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"webmproject libvpx","fixed":["1.13.1"],"affected":"< 1.13.1","ecosystem":"vendor"},{"name":"microsoft edge","fixed":[],"affected":"= 116.0.1938.98","ecosystem":"vendor"},{"name":"microsoft edge","fixed":[],"affected":"= 117.0.2045.47","ecosystem":"vendor"},{"name":"microsoft edge chromium","fixed":[],"affected":"= 116.0.5845.229","ecosystem":"vendor"},{"name":"microsoft edge chromium","fixed":[],"affected":"= 117.0.5938.132","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["115.3.1"],"affected":"< 115.3.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["118.0.1"],"affected":"< 118.0.1","ecosystem":"vendor"},{"name":"mozilla firefox","fixed":["118.1"],"affected":"< 118.1","ecosystem":"vendor"},{"name":"mozilla thunderbird","fixed":["115.3.1"],"affected":"< 115.3.1","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 37","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 12.0","ecosystem":"vendor"},{"name":"apple ipados","fixed":["17.0.3"],"affected":">= 17.0, < 17.0.3","ecosystem":"vendor"},{"name":"apple ipados","fixed":[],"affected":"= 16.7","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["17.0.3"],"affected":">= 17.0, < 17.0.3","ecosystem":"vendor"},{"name":"apple iphone os","fixed":[],"affected":"= 16.7","ecosystem":"vendor"},{"name":"google chrome","fixed":["117.0.5938.132"],"affected":"< 117.0.5938.132","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","electron","exploited","libvpx","package"],"not_affected_if":["no-browser-or-libvpx-embed"],"how_to_check":"Check the browser or app version against the vendor's fixed release (unknown from sources). For apps bundling libvpx, look for libvpx in your dependency manifests or binaries (unknown from sources).","fix":"Update Google Chrome and any other browser or app embedding libvpx to a version that includes the vendor fix (version unknown from sources). Follow vendor mitigations, or stop using affected products if none exist.","status":"open","published_at":"2023-09-28T16:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:32+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:04:32Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome and any other browser or app embedding libvpx to a version that includes the vendor fix (version unknown from sources). Follow vendor mitigations, or stop using affected products if none exist.","reach":"internet","impact":"high","summary":"A heap buffer overflow in libvpx's VP8 encoder lets a remote attacker corrupt heap memory by getting a victim to load a crafted HTML page. Attackers are known to exploit it in the wild, and the sources say it can affect any browser that uses libvpx, including Chrome.","category":"package","who_cares":["chrome","chromium","libvpx","browsers","electron"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker corrupts heap memory and may run code in the victim's browser.","analyst_note":"Confirm fixed Chrome and libvpx versions from the vendor advisory and the CISA KEV entry; sources gave no affected or fixed versions.","how_to_check":"Check the browser or app version against the vendor's fixed release (unknown from sources). For apps bundling libvpx, look for libvpx in your dependency manifests or binaries (unknown from sources).","needs_analyst":true,"not_affected_if":["no-browser-or-libvpx-embed"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000522,"input_tokens":2865,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':20A,23A '-5217':21A,24A '1.13.1':17A '117.0.5938.132':14A 'action':175C 'affect':123B 'allow':18A,144C 'apple':60A,62A,64A,67A 'appli':176C 'attack':94B,108B,147C 'browser':75B,125B,163C 'buffer':2A,84B,137C 'chrome':11A,71A,76B,130B,172C 'chromium':26A,36A,39A,77B,132C 'cisa':173C 'contain':134C 'corrupt':95B,152C 'could':160C 'craft':105B,155C 'cve':19A,22A 'debian':54A,56A,58A 'discontinu':182C 'edge':31A,33A,35A,38A 'electron':78B 'encod':6A,90B,142C 'enterprise':73A 'exploit':79B,112B,150C 'fedora':49A,51A,53A 'fedoraproject':48A,50A,52A 'firefox':41A,43A,45A 'get':99B 'googl':10A,131C,171C 'google':25A,70A 'heap':1A,83B,96B,136C,151C 'html':106B,156C 'impact':161C 'includ':129B,166C 'instruct':180C 'ipados':61A,63A 'iphone':65A,68A 'known':110B 'let':91B 'libvpx':8A,16A,27A,29A,80B,87B,128B,133C,165C 'limit':169C 'linux':55A,57A,59A,74A 'load':103B 'memori':97B 'microsoft':30A,32A,34A,37A 'mitig':177C,188C 'mozilla':40A,42A,44A,46A 'os':66A,69A 'overflow':3A,85B,138C 'packag':81B 'page':107B,157C 'per':178C 'potenti':149C 'prior':12A 'product':186C 'redhat':72A 'remot':93B,146C 'requir':174C 'say':120B 'sourc':119B 'thunderbird':47A 'unavail':190C 'use':127B,164C,183C 'vendor':179C 'via':153C 'victim':101B 'vp8':5A,89B,141C 'vulner':139C,159C 'web':162C 'webmproject':28A 'wild':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-09-28T16:15:10+00:00","kev":{"dateAdded":"2023-10-02","dueDate":"2023-10-23","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-5217","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-5217","severity":null,"published_at":"2023-10-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-5217","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5217","severity":null,"published_at":"2023-09-28T16:15:10+00:00","modified_at":"2026-06-17T06:48:06+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}