CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed

AliasesMGASA-2023-0280SUSE-SU-2023:3940-1SUSE-SU-2023:3941-1+17 more

Published 28-09-2023Last modified 21-10-2025

Vulnerability summary

CVE-2023-5217 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in Google Chromium libvpx. It is known to be exploited: CISA lists it, first on 02-10-2023. EPSS estimates a 49.01% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

49.01%

0%100%

High · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

28-09-2023
PublishedVulnerability first disclosed.
02-10-2023
Added to CISA KEVGoogle Chromium libvpx Heap Buffer Overflow Vulnerability
23-10-2023
CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21-10-2025
Last modifiedVulnerability information updated.

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS metrics

6 scores · 6 sources · 1 version

v3.18.8

EPSS trend

Probability

49.01%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 49.01% on 19-09-2026

19-09-202619-10-2026

EPSS score

49.01%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 02-10-2023
Federal due date: 23-10-2023

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html nvd.nist.gov/vuln/detail/CVE-2023-5217

Public exploits

1 found

referenceUnverified
Exploit Reference (crbug.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Suse39 products

libvpx&distro=SUSE Enterprise Storage 7.1< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.6.1-150000.6.11.1

libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 1.11.0-150400.3.3.1
libvpx&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 1.11.0-150400.3.3.1
libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP4< 1.11.0-150400.3.3.1
libvpx&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 1.11.0-150400.3.3.1
libvpx&distro=SUSE Linux Enterprise Server 12 SP5< 1.3.0-3.12.1
libvpx&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.3.0-3.12.1
libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.3.0-3.12.1
libvpx&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 1.3.0-3.12.1
libvpx&distro=SUSE Manager Proxy 4.2< 1.6.1-150000.6.11.1
libvpx&distro=SUSE Manager Server 4.2< 1.6.1-150000.6.11.1
MozillaFirefox&distro=SUSE Enterprise Storage 7.1< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 115.3.1-150000.150.110.1
MozillaFirefox&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5< 115.3.1-112.185.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 115.3.1-150000.150.110.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 115.3.1-112.185.1
MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 115.3.1-150000.150.110.1
MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 115.3.1-150200.152.111.1
MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 115.3.1-112.185.1

Show all 39

Ubuntu9 products

firefox< 118.0.1+build1-0ubuntu0.20.04.1
libvpx< 1.5.0-2ubuntu1.1+esm2 | < 1.7.0-3ubuntu0.18.04.1+esm1 | < 1.8.2-1ubuntu0.2 | < 1.11.0-2ubuntu2.2 | < 1.3.0-2ubuntu0.1~esm3
mozjs102All versions (No fix recorded)
mozjs38All versions (No fix recorded)
mozjs52All versions (No fix recorded)

Show all 9

Opensuse8 products

element-desktop&distro=openSUSE Tumbleweed< 1.11.47-1.1
libvpx&distro=openSUSE Leap 15.4< 1.11.0-150400.3.3.1 | < 1.6.1-150000.6.11.1
libvpx&distro=openSUSE Leap 15.5< 1.11.0-150400.3.3.1
libvpx&distro=openSUSE Tumbleweed< 1.13.0-2.1
MozillaFirefox&distro=openSUSE Leap 15.4< 115.3.1-150200.152.111.1

Show all 8

Debian5 products

chromium< 117.0.5938.132-1~deb12u1 | < 117.0.5938.132-1
firefox-esrAll versions (No fix recorded) | < 115.3.1esr-1~deb11u1 | < 115.3.1esr-1~deb10u1
libvpx< 1.12.0-1.1 | < 1.9.0-1+deb11u1 | < 1.12.0-1+deb12u1
thunderbird< 1:115.3.1-1~deb12u1 | < 1:115.3.1-1
debian_linuxEOL10.0 | 11.0 | 12.0

Apple2 products

ipados≥ 17.0, < 17.0.3 | 16.7
iphone_os≥ 17.0, < 17.0.3 | 16.7

Google2 products

chrome≥ 117.0.5938.132, < 117.0.5938.132 | < 117.0.5938.132
libvpx≥ 1.13.1, < 1.13.1

Mageia2 products

libvpx< 1.9.0-1.1.mga8
libvpx< 1.12.0-1.1.mga9

Microsoft2 products

edge116.0.1938.98 | 117.0.2045.47
edge_chromium116.0.5845.229 | 117.0.5938.132

Mozilla2 products

firefox< 115.3.1 | < 118.0.1 | < 118.1
thunderbird< 115.3.1

Chainguard1 product

firefox-esr< 118.0.1-r0

Fedoraproject1 product

fedoraEOL37 | 38 | 39

Npm1 product

electron< 22.3.25 | ≥ 24.0.0, < 24.8.5 | ≥ 25.0.0, < 25.8.4 | ≥ 26.0.0, < 26.2.4 | ≥ 27.0.0-alpha.1, < 27.0.0-beta.8

Redhat1 product

enterprise_linux9.0

Webmproject1 product

libvpx< 1.13.1

14 vendors · 76 products

References

98 links

chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.htmlREPORTWEBARTICLEVendor Advisory
crbug.com/1486441REPORTWEBExploitIssue Tracking
www.openwall.com/lists/oss-security/2023/09/28/5REPORTWEBMailing ListPatchThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/28/6REPORTWEBMailing ListPatchThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/1WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/2WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/7WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/9WEBMailing ListThird Party Advisory
www.mozilla.org/en-US/security/advisories/mfsa2023-44/AdvisoryThird Party Advisory
security-tracker.debian.org/tracker/CVE-2023-5217AdvisoryWEBThird Party Advisory

Show all 98 references

bugzilla.redhat.com/show_bug.cgi?id=2241191WEBREPORTIssue TrackingThird Party Advisory
stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/WEBThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/28/5WEBREPORTMailing ListThird Party Advisory
pastebin.com/TdkC4pDvWEBNot Applicable
github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590WEBFIXPatch
github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282WEBFIXPatch
github.com/webmproject/libvpx/tagsWEBProduct
www.openwall.com/lists/oss-security/2023/09/29/11WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/12WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/29/14WEBMailing ListThird Party Advisory
www.debian.org/security/2023/dsa-5510WEBAdvisoryMailing List
www.debian.org/security/2023/dsa-5509WEBAdvisoryMailing List
www.debian.org/security/2023/dsa-5508WEBAdvisoryMailing List
www.openwall.com/lists/oss-security/2023/09/30/1WEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2023/09/msg00038.htmlWEBMailing List
twitter.com/maddiestone/status/1707163313711497266WEBThird Party Advisory
arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/WEBThird Party Advisory
github.com/webmproject/libvpx/releases/tag/v1.13.1WEBRelease Notes
www.openwall.com/lists/oss-security/2023/09/30/3WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/30/2WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/30/4WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/09/30/5WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing List
www.openwall.com/lists/oss-security/2023/10/01/2WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/10/01/1WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/10/01/5WEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2023/10/msg00001.htmlWEBMailing List
lists.fedoraproject.org/archives/…WEBMailing List
lists.fedoraproject.org/archives/…WEBMailing List
lists.fedoraproject.org/archives/…WEBMailing List
lists.fedoraproject.org/archives/…WEBMailing List
www.openwall.com/lists/oss-security/2023/10/02/6WEBMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2023/10/03/11WEBMailing ListThird Party Advisory
security.gentoo.org/glsa/202310-04WEBAdvisoryThird Party Advisory
support.apple.com/kb/HT213961WEBThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing List
seclists.org/fulldisclosure/2023/Oct/12WEBMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2023/10/msg00015.htmlWEBMailing List
support.apple.com/kb/HT213972WEBThird Party Advisory
seclists.org/fulldisclosure/2023/Oct/16WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing List
security.gentoo.org/glsa/202401-34WEBAdvisoryThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217Government ResourceWEBUS Government Resource
advisories.mageia.org/MGASA-2023-0280.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=32342REPORT
www.cve.org/CVERecord?id=CVE-2023-5217AdvisoryREPORT
www.suse.com/support/update/announcement/2023/suse-su-20233940-1/Advisory
bugzilla.suse.com/1215778REPORT
www.suse.com/security/cve/CVE-2023-5217WEB
www.suse.com/support/update/announcement/2023/suse-su-20233941-1/Advisory
bugzilla.suse.com/1215814REPORT
www.suse.com/support/update/announcement/2023/suse-su-20233946-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20233948-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20233949-1/Advisory
www.suse.com/support/update/announcement/2023/suse-su-20233950-1/Advisory
ubuntu.com/security/CVE-2023-5217REPORT
www.mozilla.org/en-US/security/advisories/mfsa2023-44/REPORT
hg.mozilla.org/mozilla-central/rev/c53f5ef77b62b79af86951a7f9130e1896b695d2REPORT
ubuntu.com/security/notices/USN-6403-1Advisory
ubuntu.com/security/notices/USN-6404-1Advisory
ubuntu.com/security/notices/USN-6405-1Advisory
ubuntu.com/security/notices/USN-6403-2Advisory
ubuntu.com/security/notices/USN-6403-3Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
ubuntu.com/security/notices/USN-7172-1Advisory
nvd.nist.gov/vuln/detail/CVE-2023-5217Advisory
github.com/electron/electron/pull/40022WEB
github.com/electron/electron/pull/40023WEB
github.com/electron/electron/pull/40024WEB
github.com/electron/electron/pull/40025WEB
github.com/electron/electron/pull/40026WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217WEB
www.mozilla.org/en-US/security/advisories/mfsa2023-44WEB
arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-softwareWEB
github.com/electron/electronPACKAGE
github.com/electron/electron/releases/tag/v22.3.25WEB
github.com/electron/electron/releases/tag/v24.8.5WEB
github.com/electron/electron/releases/tag/v25.8.4WEB
github.com/electron/electron/releases/tag/v26.2.4WEB
github.com/electron/electron/releases/tag/v27.0.0-beta.8WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5217.jsonAdvisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities