CVE-2023-5217

KEVGoogle Chromium libvpx Heap Buffer Overflow Vulnerability

Description

Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedSep 28, 2023

Last modifiedJun 17, 2026

Added to KEVOct 2, 2023

Remediation dueOct 23, 2023

References

seclists.org/fulldisclosure/2023/Oct/12Mailing ListThird Party Advisory
seclists.org/fulldisclosure/2023/Oct/16Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/28/5Mailing ListPatch
openwall.com/lists/oss-security/2023/09/28/6Mailing ListPatch
openwall.com/lists/oss-security/2023/09/29/1Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/11Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/12Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/14Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/2Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/7Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/29/9Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2023/09/30/1Mailing ListThird Party Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1100 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 49.0% · top 1% of all CVEs
Weakness: CWE-787
Attack vector: Network, remotely reachable

Recommended actions

1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.