erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record · Known exploited

CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability

Exploited in the wild (CISA KEV). Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CISA KEV · added 2023-10-02 CVSS 8.8 High EPSS 49.0% · p99

Updated By erroneo.us Security Desk55 references Seen in the digest for Oct 2, 2023

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Yes, if you run Google Chromium libvpx. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-02, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-10-23; treat that as the outer limit, not the target.
  • EPSS 49.0%, percentile 99: FIRST’s model estimates a 49.0% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

What it is

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CISA’s summary

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

Weakness type: CWE-787.

Product: Google Chromium libvpx · Assigned by: Chrome · Published: 2023-09-28

Affected and fixed versions

VendorProductAffected versions (per CVE record)
GoogleChrome117.0.5938.132 < 117.0.5938.132
Googlelibvpx1.13.1 < 1.13.1

Severity scores

Scored byCVSSScoreVector
CISA-ADP3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: required (a user must click/open something)
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: added 2023-10-02; federal due date 2023-10-23. Known ransomware use: Unknown.
  • CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • CISA SSVC assessment: exploitation active, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 49.01% probability of exploitation activity in the next 30 days; percentile 99.

Timeline

  • — CVE record published by Chrome
  • — Added to CISA’s Known Exploited Vulnerabilities catalog
  • — CISA remediation deadline for US federal agencies
  • — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. Listed in CISA KEV notes (chromereleases.googleblog.com) chromereleases.googleblog.com

Vulnerability records

  1. CVE.org record CVE-2023-5217 cve.org
  2. NVD entry CVE-2023-5217 nvd.nist.gov

Government

  1. CISA Known Exploited Vulnerabilities catalog entry cisa.gov

Other references from the CVE record and advisory

  1. crbug.com crbug.com
  2. openwall.com openwall.com
  3. openwall.com openwall.com
  4. openwall.com openwall.com
  5. openwall.com openwall.com
  6. openwall.com openwall.com
  7. openwall.com openwall.com
  8. mozilla.org mozilla.org
  9. security-tracker.debian.org security-tracker.debian.org
  10. bugzilla.redhat.com bugzilla.redhat.com
  11. stackdiary.com stackdiary.com
  12. openwall.com openwall.com
  13. pastebin.com pastebin.com
  14. github.com github.com
  15. github.com github.com
  16. github.com github.com
  17. openwall.com openwall.com
  18. openwall.com openwall.com
  19. openwall.com openwall.com
  20. debian.org debian.org
  21. debian.org debian.org
  22. debian.org debian.org
  23. openwall.com openwall.com
  24. lists.debian.org lists.debian.org
  25. twitter.com twitter.com
  26. arstechnica.com arstechnica.com
  27. github.com github.com
  28. openwall.com openwall.com
  29. openwall.com openwall.com
  30. openwall.com openwall.com
  31. openwall.com openwall.com
  32. lists.fedoraproject.org lists.fedoraproject.org
  33. openwall.com openwall.com
  34. openwall.com openwall.com
  35. openwall.com openwall.com
  36. lists.debian.org lists.debian.org
  37. lists.fedoraproject.org lists.fedoraproject.org
  38. lists.fedoraproject.org lists.fedoraproject.org
  39. lists.fedoraproject.org lists.fedoraproject.org
  40. lists.fedoraproject.org lists.fedoraproject.org
  41. openwall.com openwall.com
  42. openwall.com openwall.com
  43. security.gentoo.org security.gentoo.org
  44. support.apple.com support.apple.com
  45. lists.fedoraproject.org lists.fedoraproject.org
  46. seclists.org seclists.org
  47. lists.debian.org lists.debian.org
  48. support.apple.com support.apple.com
  49. seclists.org seclists.org
  50. lists.fedoraproject.org lists.fedoraproject.org
  51. security.gentoo.org security.gentoo.org

All exploited Google vulnerabilities · Today’s Security Digest