---
title: "CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability"
url: https://erroneo.us/security/cve/CVE-2023-5217/
description: "CVE-2023-5217 (Google Chromium libvpx): Exploited in the wild (CISA KEV). Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-09-28
date_modified: 2025-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-5217"
kev: true
cvss: 8.8
epss: 0.49013
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-5217: Google Chromium libvpx Heap Buffer Overflow Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Google Chromium libvpx. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-02, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-10-23 ; treat that as the outer limit, not the target.
- EPSS 49.0% , percentile 99: FIRST’s model estimates a 49.0% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

## What it is

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

## Affected products (CVE record)

- Google Chrome: 117.0.5938.132 < 117.0.5938.132
- Google libvpx: 1.13.1 < 1.13.1

## Severity

- CISA-ADP CVSS 3.1: 8.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2023-10-02; federal due date 2023-10-23. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 49.01% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [Listed in CISA KEV notes (chromereleases.googleblog.com)](https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html)
- [CVE.org record CVE-2023-5217](https://www.cve.org/CVERecord?id=CVE-2023-5217)
- [NVD entry CVE-2023-5217](https://nvd.nist.gov/vuln/detail/CVE-2023-5217)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217)
- [crbug.com](https://crbug.com/1486441)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/28/5)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/28/6)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/1)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/2)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/7)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/9)
- [mozilla.org](https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/)
- [security-tracker.debian.org](https://security-tracker.debian.org/tracker/CVE-2023-5217)
- [bugzilla.redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=2241191)
- [stackdiary.com](https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/)
- [openwall.com](https://www.openwall.com/lists/oss-security/2023/09/28/5)
- [pastebin.com](https://pastebin.com/TdkC4pDv)
- [github.com](https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590)
- [github.com](https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282)
- [github.com](https://github.com/webmproject/libvpx/tags)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/11)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/12)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/29/14)
- [debian.org](https://www.debian.org/security/2023/dsa-5510)
- [debian.org](https://www.debian.org/security/2023/dsa-5509)
- [debian.org](https://www.debian.org/security/2023/dsa-5508)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/30/1)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html)
- [twitter.com](https://twitter.com/maddiestone/status/1707163313711497266)
- [arstechnica.com](https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/)
- [github.com](https://github.com/webmproject/libvpx/releases/tag/v1.13.1)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/30/3)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/30/2)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/30/4)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/09/30/5)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/10/01/2)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/10/01/1)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/10/01/5)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/10/02/6)
- [openwall.com](http://www.openwall.com/lists/oss-security/2023/10/03/11)
- [security.gentoo.org](https://security.gentoo.org/glsa/202310-04)
- [support.apple.com](https://support.apple.com/kb/HT213961)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/)
- [seclists.org](http://seclists.org/fulldisclosure/2023/Oct/12)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html)
- [support.apple.com](https://support.apple.com/kb/HT213972)
- [seclists.org](http://seclists.org/fulldisclosure/2023/Oct/16)
- [lists.fedoraproject.org](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/)
- [security.gentoo.org](https://security.gentoo.org/glsa/202401-34)

---
Source page: https://erroneo.us/security/cve/CVE-2023-5217/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt