libvpx CVE-2023-5217: Exploited VP8 Encoder Overflow

What to do

1. Confirm browsers are current (Chrome at least 117.0.5938.132, Firefox at least 118.0.1 or ESR 115.3.1); any auto-updating install is far past this.
2. Check distro libvpx packages by changelog, not version number, because distributions backported the fix to older releases.
3. Search static binaries such as ffmpeg builds for the embedded libvpx version and rebuild anything below v1.13.1.
4. Inventory Electron apps and update or remove any built on Electron older than the fixed releases, including every 23.x app.
5. Retire or isolate end-of-life hosts and devices that can no longer receive libvpx, browser or iOS updates.

How to check if you are affected or compromised

• Google and Mozilla published no indicators of compromise; for most organizations the check is inventory of unpatched VP8 encoders, not forensics.
• For people at high risk of targeted surveillance who ran Chrome before 117.0.5938.132 or Firefox before 118.0.1 in September 2023, consider a specialist forensic review of those devices.

What happened#

On September 27, 2023, Google shipped Chrome 117.0.5938.132 to fix CVE-2023-5217, a heap buffer overflow in the VP8 encoder of libvpx, the WebM video codec library. Clément Lecigne of Google's Threat Analysis Group (TAG) reported it two days earlier. The release notes say "Google is aware that an exploit for CVE-2023-5217 exists in the wild." Per The Hacker News, TAG's Maddie Stone said a commercial spyware vendor was using it. No vendor has been named. CISA added it to KEV on October 2, 2023. NVD scores it 8.8.

The upstream fix, "VP8: disallow thread count changes," stops a live encoder from being reconfigured in a way its memory allocations did not expect. The fix shipped in libvpx 1.13.1 on September 29.

Who is affected#

libvpx ships in far more than Chrome. Fixed builds:

• Chrome 117.0.5938.132 on desktop, and 117.0.5938.140 on Android.
• Firefox 118.0.1, Firefox ESR 115.3.1 and Thunderbird 115.3.1 (MFSA 2023-44). Mozilla knew of it "being exploited in other products in the wild."
• Microsoft Edge 117.0.2045.47, and Extended Stable 116.0.1938.98 (Edge notes).
• Electron 22.3.25, 24.8.5, 25.8.4 and 26.2.4. Electron's last 23.x release predates the fix, so that line never got it.
• iOS and iPadOS 17.0.3 and 16.7.1, where Apple updated WebRTC to libvpx 1.13.1.
• Backported distro packages, such as Debian 1.12.0-1+deb12u1 (tracker) and Ubuntu 22.04's 1.11.0-2ubuntu2.2 (tracker). Ubuntu 18.04 and 16.04 need Ubuntu Pro.

Do you really need to act?#

Not for browsers. Chrome, Firefox and Edge fixed this within two days and have updated many times since. Chrome reached version 156 on October 20, 2026. The remaining risk is copies of libvpx that do not update themselves:

• Electron apps frozen on 2023-era builds.
• iPhones and iPads stuck below iOS 16.7.1.
• End-of-life Linux hosts. Debian lists chromium on buster as unfixed.
• Static media tools, such as ffmpeg builds that bundle libvpx.

The bug is in encoding, not decoding. In the exploited path, a crafted web page drove the browser's encoder. A decode-only player never runs this code, and a batch transcoder with fixed settings is a much harder target. Patch both, but neither is an emergency.

What to do now#

1. Confirm that google-chrome --version reports at least 117.0.5938.132 and firefox --version reports at least 118.0.1 (or ESR 115.3.1).
2. On Debian or Ubuntu, run dpkg -l 'libvpx*', then apt changelog libvpx7 | grep -m1 CVE-2023-5217 with your package name. On RPM systems, run rpm -q --changelog libvpx | grep CVE-2023-5217. Distributions backported the fix, so version numbers mislead.
3. For static binaries, strings -a ./ffmpeg | grep -m1 'WebM Project VP8 Encoder' prints the embedded libvpx version. Rebuild anything below v1.13.1.
4. Check the Electron version inside each desktop app. On macOS, run defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion. Update or remove anything below its line's fix, and anything on 23.x.
5. Retire or isolate end-of-life hosts and devices that no longer get updates.

How to tell if you were hit#

Google and Mozilla published no indicators of compromise. The only public account is a spyware vendor targeting chosen people in 2023. For most organizations, the useful check is an inventory of unpatched encoders that remain today. If a high-risk user, such as a journalist, activist or official, ran Chrome before 117.0.5938.132 or Firefox before 118.0.1 that September, a specialist forensic review of their device is reasonable.

Timeline#

• Sep 25, 2023 — Google TAG reports the bug to Chrome.
• Sep 27, 2023 — Chrome 117.0.5938.132 ships with an in-the-wild warning.
• Sep 28, 2023 — Mozilla and Electron ship fixes, the CVE is published, and an oss-security post flags the libvpx commits.
• Sep 29, 2023 — libvpx 1.13.1 and Edge 117.0.2045.47 ship.
• Oct 2, 2023 — CISA adds the CVE to KEV, due October 23.
• Oct 4, 2023 — Apple ships iOS 17.0.3, then iOS 16.7.1 on October 10.

Vulnerability records

• CVE-2023-5217 · KEV 2023-10-02 · Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Sep 27, 2023) chromereleases.googleblog.com
2. Google Chrome Releases — Chrome for Android Update (Sep 27, 2023) chromereleases.googleblog.com
3. Mozilla — MFSA 2023-44: Security Vulnerability fixed in Firefox 118.0.1, Firefox ESR 115.3.1 and Thunderbird 115.3.1 mozilla.org
4. WebM Project — libvpx v1.13.1 release github.com
5. WebM Project — libvpx commit: VP8: disallow thread count changes github.com
6. CVE record — CVE-2023-5217 cve.org
7. NVD — CVE-2023-5217 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2023-5217 cisa.gov
9. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
10. Electron — v26.2.4 release notes github.com
11. Apple — About the security content of iOS 17.0.3 and iPadOS 17.0.3 support.apple.com
12. Apple — About the security content of iOS 16.7.1 and iPadOS 16.7.1 support.apple.com
13. Debian — Security tracker: CVE-2023-5217 security-tracker.debian.org
14. Ubuntu — CVE-2023-5217 ubuntu.com
15. Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026) chromereleases.googleblog.com
16. oss-security — CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx openwall.com

Coverage and analysis

1. The Hacker News — Update Chrome now: Google releases patch for actively exploited zero-day thehackernews.com