CVE-2025-5283 json
Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a cra…
published 2025-05-27 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16294
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Patch / fix
- google chrome 137.0.7151.55
- mozilla firefox 128.11, 139
- mozilla firefox_esr 128.11, 139
- mozilla thunderbird 128.11
- mozilla thunderbird_esr 128.11
- libvpx Debian 12 1.12.0-1+deb12u4
- libvpx Debian 14, Debian 13 1.15.0-2.1
- chromium Debian 12 137.0.7151.55-3~deb12u1
- chromium Debian 14, Debian 13 137.0.7151.55-1
- firefox-esr Debian 12 128.11.0esr-1~deb12u1
- firefox-esr Debian 14, Debian 13 128.11.0esr-1
- thunderbird Debian 12 1:128.11.0esr-1~deb12u1
- thunderbird Debian 14, Debian 13 1:128.11.0esr-1
debian advisories DEBIAN-CVE-2025-5283
- libvpx Ubuntu 20.04 LTS 1.8.2-1ubuntu0.4
- libvpx Ubuntu 22.04 LTS 1.11.0-2ubuntu2.4
- libvpx Ubuntu 24.04 LTS 1.14.0-1ubuntu2.2
- thunderbird Ubuntu 22.04 LTS 1:140.7.1+build1-0ubuntu0.22.04.1
- libvpx Ubuntu Pro 16.04 LTS 1.5.0-2ubuntu1.1+esm4
- libvpx Ubuntu Pro 18.04 LTS 1.7.0-3ubuntu0.18.04.1+esm3
ubuntu advisories UBUNTU-CVE-2025-5283
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- libvpx RHEL 10.0 1.14.1-3.el10_0
- libvpx RHEL 9 1.9.0-9.el9_6
- libvpx RHEL 8 1.7.0-12.el8_10
- thunderbird RHEL 8 128.11.0-1.el8_10
- thunderbird RHEL 9 128.11.0-1.el9_6
- thunderbird RHEL 10.0 128.11.0-1.el10_0
- firefox RHEL 10.0 128.11.0-1.el10_0
- firefox RHEL 8 128.11.0-1.el8_10
red hat advisories RHSA-2025:9331RHSA-2025:9155RHSA-2025:9128RHSA-2025:9126RHSA-2025:9127RHSA-2025:9124
- mozjs128 SLES for SAP applications 16.0, SLES 16.0 128.14.0-160000.1.1
suse advisories SUSE-SU-2025:21170-1
- mozjs128 openSUSE Leap 16.0 128.14.0-160000.1.1
- mozjs128 openSUSE Tumbleweed 128.12.0-1.1
- chromium openSUSE Tumbleweed 138.0.7204.96-1.1
opensuse advisories openSUSE-SU-2025:20135-1openSUSE-SU-2025:15315-1openSUSE-SU-2025:15210-1
- libvpx AlmaLinux 9 1.9.0-9.el9_6
- libvpx AlmaLinux 8 1.7.0-12.el8_10
- libvpx AlmaLinux 10 1.14.1-3.el10_0
- thunderbird AlmaLinux 9 128.11.0-1.el9_6.alma.1
- firefox AlmaLinux 10 128.11.0-1.el10_0
- firefox AlmaLinux 8 128.11.0-1.el8_10.alma.1
almalinux advisories ALSA-2025:9118ALSA-2025:9119ALSA-2025:9120ALSA-2025:8607ALSA-2025:8341ALSA-2025:8308
- firefox Rocky Linux 9 128.11.0-1.el9_6
- thunderbird Rocky Linux 9 128.11.0-1.el9_6
- libvpx Rocky Linux 9 1.9.0-9.el9_6
- firefox Rocky Linux 10 128.11.0-1.el10_0
- thunderbird Rocky Linux 10 128.11.0-1.el10_0
- libvpx Rocky Linux 10 1.14.1-3.el10_0
- firefox Rocky Linux 8 128.11.0-1.el8_10
- thunderbird Rocky Linux 8 128.11.0-1.el8_10
rocky linux advisories RLSA-2025:8293RLSA-2025:8607RLSA-2025:9118RLSA-2025:8341RLSA-2025:8608RLSA-2025:9120
- qt6-qtwebengine Alpine 3.24, Alpine 3.23, Alpine 3.22 6.8.3-r1
alpine advisories ALPINE-CVE-2025-5283
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-5283 updated cvss 8.1
libvpx: Double-free in libvpx encoder
-
Red Hat Enterprise Linux 6 libvpx, libvpx-utilsaffected: workaround, no fix planned “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.”
-
Red Hat Enterprise Linux 10 firefox-flatpak, thunderbird-flatpakaffected: workaround, no fix available “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.”
-
Red Hat CodeReady Linux Builder EUS (v.9.4) libvpx-devel 1.9.0-7.el9_4.1, libvpx-debuginfo 1.9.0-7.el9_4.1, libvpx-debugsource 1.9.0-7.el9_4.1, libvpx-utils-debuginfo 1.9.0-7.el9_4.1fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9122
-
Red Hat Enterprise Linux AppStream (v. 8) libvpx 1.7.0-12.el8_10, firefox 128.11.0-1.el8_10, thunderbird 128.11.0-1.el8_10fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:8308
-
Red Hat Enterprise Linux AppStream (v. 9) libvpx 1.9.0-9.el9_6, firefox 128.11.0-1.el9_6, firefox-x11 128.11.0-1.el9_6, thunderbird 128.11.0-1.el9_6fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:8293
-
Red Hat Enterprise Linux AppStream (v. 10) libvpx 1.14.1-3.el10_0, firefox 128.11.0-1.el10_0, thunderbird 128.11.0-1.el10_0fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:8341
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) libvpx 1.7.0-8.el8_2.1, firefox 128.11.0-1.el8_2, thunderbird 128.11.0-1.el8_2fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9075
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) libvpx 1.7.0-10.el8_4.1, firefox 128.11.0-1.el8_4, thunderbird 128.11.0-1.el8_4fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9076
show 12 moreshow fewer
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) libvpx 1.7.0-10.el8_6.1, firefox 128.11.0-1.el8_6, thunderbird 128.11.0-1.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) libvpx 1.7.0-10.el8_6.1, firefox 128.11.0-1.el8_6, thunderbird 128.11.0-1.el8_6fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9155
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) libvpx 1.7.0-10.el8_8.1, firefox 128.11.0-1.el8_8, thunderbird 128.11.0-1.el8_8fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9077
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) libvpx 1.9.0-7.el9_0.1, firefox 128.11.0-1.el9_0, thunderbird 128.11.0-1.el9_0fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9073
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) libvpx 1.9.0-7.el9_2.1, firefox 128.11.0-1.el9_2, firefox-x11 128.11.0-1.el9_2, thunderbird 128.11.0-1.el9_2fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9071
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) libvpx 1.9.0-7.el9_4.1, firefox 128.11.0-1.el9_4, firefox-x11 128.11.0-1.el9_4, thunderbird 128.11.0-1.el9_4fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9072
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) libvpx 1.7.0-10.el8_6.1, firefox 128.11.0-1.el8_6, thunderbird 128.11.0-1.el8_6fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9155
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) libvpx 1.7.0-10.el8_8.1, thunderbird 128.11.0-1.el8_8fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9125
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libvpx-devel 1.9.0-9.el9_6, libvpx-debuginfo 1.9.0-9.el9_6, libvpx-debugsource 1.9.0-9.el9_6, libvpx-utils-debuginfo 1.9.0-9.el9_6fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9118
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libvpx-devel 1.14.1-3.el10_0, libvpx-debuginfo 1.14.1-3.el10_0, libvpx-debugsource 1.14.1-3.el10_0, libvpx-utils-debuginfo 1.14.1-3.el10_0fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9120
-
Red Hat Enterprise Linux CRB (v. 8) libvpx-devel 1.7.0-12.el8_10, libvpx-debuginfo 1.7.0-12.el8_10, libvpx-debugsource 1.7.0-12.el8_10, libvpx-utils-debuginfo 1.7.0-12.el8_10fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9119
-
Red Hat Enterprise Linux Server (v. 7 ELS) libvpx 1.3.0-8.el7_9.1, firefox 128.11.0-1.el7_9fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9074
-
Red Hat Enterprise Linux Server Optional (v. 7 ELS) libvpx-utils 1.3.0-8.el7_9.1fixed: vendor fix “Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.” RHSA-2025:9331
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Affected products
- Google Chrome
Classification
- Weakness
-
- CWE-416 Use After Free
- Technology feeds
References
-
chromereleases.googleblog.com
/2025/05/stable-channel-update-for-desktop_27.html
release-notes
-
issues.chromium.org
/issues/419467315
permissions-required
- lists.debian.org /debian-lts-announce/2025/05/msg00052.html
- lists.debian.org /debian-lts-announce/2025/05/msg00046.html
- lists.debian.org /debian-lts-announce/2025/05/msg00043.html
Sources
- CVE List CVE-2025-5283
- NVD CVE-2025-5283
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.