---
title: "libvpx CVE-2023-5217: Exploited VP8 Encoder Overflow"
url: https://erroneo.us/security/briefs/libvpx-chrome-cve-2023-5217-vp8-heap-overflow/
description: "2023 libvpx VP8 encoder overflow, exploited via Chrome. Fixed in Chrome 117.0.5938.132, Firefox 118.0.1, libvpx 1.13.1. Check bundled and EOL copies."
type: security-brief
section: "Security Digest"
date_published: 2023-09-27
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-5217"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# libvpx CVE-2023-5217: Exploited VP8 Encoder Overflow

**Verdict: Check exposure.** Browsers fixed this within days in 2023 and have auto-updated many times since; what is left is stale libvpx copies in Electron apps, old iPhones, end-of-life Linux hosts and statically built media tools.

- **Who must act:** Owners of Electron apps or static media binaries built before late September 2023, end-of-life Linux hosts that still use libvpx, and fleets of iPhones or iPads stuck below iOS 16.7.1.
- **Who can relax:** Anyone on an auto-updating Chrome, Firefox or Edge, and supported Linux distributions with current security updates, which shipped backported libvpx fixes in 2023.
- **Affected:** libvpx before 1.13.1, unless the distribution backported the fix; Google Chrome before 117.0.5938.132; Chrome for Android before 117.0.5938.140; Firefox before 118.0.1, Firefox ESR before 115.3.1, Thunderbird before 115.3.1; Microsoft Edge before 117.0.2045.47 (Extended Stable before 116.0.1938.98); Electron before 22.3.25, 24.8.5, 25.8.4 or 26.2.4 on each line, and all of 23.x; iOS and iPadOS before 16.7.1 and 17.0.3
- **Fixed:** libvpx 1.13.1 (Sep 29, 2023); Chrome 117.0.5938.132 (Windows, Mac, Linux) and Chrome for Android 117.0.5938.140; Firefox 118.0.1, Firefox ESR 115.3.1, Firefox for Android 118.1, Thunderbird 115.3.1; Microsoft Edge 117.0.2045.47 and Extended Stable 116.0.1938.98; Electron 22.3.25, 24.8.5, 25.8.4, 26.2.4; iOS/iPadOS 17.0.3 and 16.7.1; Debian libvpx 1.9.0-1+deb11u1 and 1.12.0-1+deb12u1; Ubuntu libvpx 1.11.0-2ubuntu2.2 (22.04) and 1.8.2-1ubuntu0.2 (20.04)
- **CVEs:** CVE-2023-5217
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm browsers are current (Chrome at least 117.0.5938.132, Firefox at least 118.0.1 or ESR 115.3.1); any auto-updating install is far past this.
2. Check distro libvpx packages by changelog, not version number, because distributions backported the fix to older releases.
3. Search static binaries such as ffmpeg builds for the embedded libvpx version and rebuild anything below v1.13.1.
4. Inventory Electron apps and update or remove any built on Electron older than the fixed releases, including every 23.x app.
5. Retire or isolate end-of-life hosts and devices that can no longer receive libvpx, browser or iOS updates.

### How to check if you are affected

- Google and Mozilla published no indicators of compromise; for most organizations the check is inventory of unpatched VP8 encoders, not forensics.
- For people at high risk of targeted surveillance who ran Chrome before 117.0.5938.132 or Firefox before 118.0.1 in September 2023, consider a specialist forensic review of those devices.

## What happened

On September 27, 2023, Google shipped Chrome 117.0.5938.132 to fix [CVE-2023-5217](https://www.cve.org/CVERecord?id=CVE-2023-5217), a heap buffer overflow in the VP8 encoder of libvpx, the WebM video codec library. Clément Lecigne of Google's Threat Analysis Group (TAG) reported it two days earlier. The [release notes](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html) say "Google is aware that an exploit for CVE-2023-5217 exists in the wild." Per [The Hacker News](https://thehackernews.com/2023/09/update-chrome-now-google-releases-patch.html), TAG's Maddie Stone said a commercial spyware vendor was using it. No vendor has been named. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217) on October 2, 2023. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5217) scores it 8.8.

The [upstream fix](https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590), "VP8: disallow thread count changes," stops a live encoder from being reconfigured in a way its memory allocations did not expect. The fix shipped in [libvpx 1.13.1](https://github.com/webmproject/libvpx/releases/tag/v1.13.1) on September 29.

## Who is affected

libvpx ships in far more than Chrome. Fixed builds:

- Chrome 117.0.5938.132 on desktop, and [117.0.5938.140 on Android](https://chromereleases.googleblog.com/2023/09/chrome-for-android-update_0480966349.html).
- Firefox 118.0.1, Firefox ESR 115.3.1 and Thunderbird 115.3.1 ([MFSA 2023-44](https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/)). Mozilla knew of it "being exploited in other products in the wild."
- Microsoft Edge 117.0.2045.47, and Extended Stable 116.0.1938.98 ([Edge notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)).
- Electron 22.3.25, 24.8.5, 25.8.4 and [26.2.4](https://github.com/electron/electron/releases/tag/v26.2.4). Electron's last 23.x release predates the fix, so that line never got it.
- iOS and iPadOS [17.0.3](https://support.apple.com/en-us/106367) and [16.7.1](https://support.apple.com/en-us/106359), where Apple updated WebRTC to libvpx 1.13.1.
- Backported distro packages, such as Debian 1.12.0-1+deb12u1 ([tracker](https://security-tracker.debian.org/tracker/CVE-2023-5217)) and Ubuntu 22.04's 1.11.0-2ubuntu2.2 ([tracker](https://ubuntu.com/security/CVE-2023-5217)). Ubuntu 18.04 and 16.04 need Ubuntu Pro.

## Do you really need to act?

Not for browsers. Chrome, Firefox and Edge fixed this within two days and have updated many times since. Chrome reached version 156 on [October 20, 2026](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). The remaining risk is copies of libvpx that do not update themselves:

- Electron apps frozen on 2023-era builds.
- iPhones and iPads stuck below iOS 16.7.1.
- End-of-life Linux hosts. Debian lists chromium on buster as unfixed.
- Static media tools, such as ffmpeg builds that bundle libvpx.

The bug is in encoding, not decoding. In the exploited path, a crafted web page drove the browser's encoder. A decode-only player never runs this code, and a batch transcoder with fixed settings is a much harder target. Patch both, but neither is an emergency.

## What to do now

1. Confirm that `google-chrome --version` reports at least 117.0.5938.132 and `firefox --version` reports at least 118.0.1 (or ESR 115.3.1).
2. On Debian or Ubuntu, run `dpkg -l 'libvpx*'`, then `apt changelog libvpx7 | grep -m1 CVE-2023-5217` with your package name. On RPM systems, run `rpm -q --changelog libvpx | grep CVE-2023-5217`. Distributions backported the fix, so version numbers mislead.
3. For static binaries, `strings -a ./ffmpeg | grep -m1 'WebM Project VP8 Encoder'` prints the embedded libvpx version. Rebuild anything below v1.13.1.
4. Check the Electron version inside each desktop app. On macOS, run `defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion`. Update or remove anything below its line's fix, and anything on 23.x.
5. Retire or isolate end-of-life hosts and devices that no longer get updates.

## How to tell if you were hit

Google and Mozilla published no indicators of compromise. The only public account is a spyware vendor targeting chosen people in 2023. For most organizations, the useful check is an inventory of unpatched encoders that remain today. If a high-risk user, such as a journalist, activist or official, ran Chrome before 117.0.5938.132 or Firefox before 118.0.1 that September, a specialist forensic review of their device is reasonable.

## Timeline

- Sep 25, 2023 — Google TAG reports the bug to Chrome.
- Sep 27, 2023 — Chrome 117.0.5938.132 ships with an in-the-wild warning.
- Sep 28, 2023 — Mozilla and Electron ship fixes, the CVE is published, and an [oss-security post](https://www.openwall.com/lists/oss-security/2023/09/28/5) flags the libvpx commits.
- Sep 29, 2023 — libvpx 1.13.1 and Edge 117.0.2045.47 ship.
- Oct 2, 2023 — CISA adds the CVE to KEV, due October 23.
- Oct 4, 2023 — Apple ships iOS 17.0.3, then iOS 16.7.1 on October 10.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Sep 27, 2023)](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html)
2. [Google Chrome Releases — Chrome for Android Update (Sep 27, 2023)](https://chromereleases.googleblog.com/2023/09/chrome-for-android-update_0480966349.html)
3. [Mozilla — MFSA 2023-44: Security Vulnerability fixed in Firefox 118.0.1, Firefox ESR 115.3.1 and Thunderbird 115.3.1](https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/)
4. [WebM Project — libvpx v1.13.1 release](https://github.com/webmproject/libvpx/releases/tag/v1.13.1)
5. [WebM Project — libvpx commit: VP8: disallow thread count changes](https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590)
6. [CVE record — CVE-2023-5217](https://www.cve.org/CVERecord?id=CVE-2023-5217)
7. [NVD — CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217)
8. [CISA — Known Exploited Vulnerabilities: CVE-2023-5217](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217)
9. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
10. [Electron — v26.2.4 release notes](https://github.com/electron/electron/releases/tag/v26.2.4)
11. [Apple — About the security content of iOS 17.0.3 and iPadOS 17.0.3](https://support.apple.com/en-us/106367)
12. [Apple — About the security content of iOS 16.7.1 and iPadOS 16.7.1](https://support.apple.com/en-us/106359)
13. [Debian — Security tracker: CVE-2023-5217](https://security-tracker.debian.org/tracker/CVE-2023-5217)
14. [Ubuntu — CVE-2023-5217](https://ubuntu.com/security/CVE-2023-5217)
15. [Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html)
16. [oss-security — CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx](https://www.openwall.com/lists/oss-security/2023/09/28/5)
17. [The Hacker News — Update Chrome now: Google releases patch for actively exploited zero-day](https://thehackernews.com/2023/09/update-chrome-now-google-releases-patch.html)

---
Source page: https://erroneo.us/security/briefs/libvpx-chrome-cve-2023-5217-vp8-heap-overflow/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt