CVE-2023-5217 kev in the critical feed json
Electron affected by libvpx's heap buffer overflow in vp8 encoding
published 2023-09-28 3 y ago modified 2026-09-10 1 mo ago also EUVD-2023-2578 , GHSA-qqvq-6xgj-jw8g , JLSEC-2026-375
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-10-02
- epss
- 49.0%
- EPSS 49.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- npm electron 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8
- julia LibVPX_jll 1.15.2+0
- webmproject libvpx 1.13.1
- mozilla firefox 115.3.1, 118.0.1, 118.1
- mozilla thunderbird 115.3.1
- google chrome 117.0.5938.132
- apple ipados 17.0.3
- apple iphone_os 17.0.3
- libvpx Debian 12 1.12.0-1+deb12u1
- libvpx Debian 14, Debian 13 1.12.0-1.1
- chromium Debian 12 117.0.5938.132-1~deb12u1
- chromium Debian 14, Debian 13 117.0.5938.132-1
- thunderbird Debian 12 1:115.3.1-1~deb12u1
- thunderbird Debian 14, Debian 13 1:115.3.1-1
debian advisories DEBIAN-CVE-2023-5217
- libvpx Ubuntu 20.04 LTS 1.8.2-1ubuntu0.2
- libvpx Ubuntu 22.04 LTS 1.11.0-2ubuntu2.2
- firefox Ubuntu 20.04 LTS 118.0.1+build1-0ubuntu0.20.04.1
- thunderbird Ubuntu 20.04 LTS 1:115.3.1+build1-0ubuntu0.20.04.1
- thunderbird Ubuntu 22.04 LTS 1:115.3.1+build1-0ubuntu0.22.04.2
- thunderbird Ubuntu 24.04 LTS 1:115.3.1+build1-0ubuntu1
- libvpx Ubuntu Pro 14.04 LTS 1.3.0-2ubuntu0.1~esm3
- libvpx Ubuntu Pro 16.04 LTS 1.5.0-2ubuntu1.1+esm2
ubuntu advisories UBUNTU-CVE-2023-5217
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- libvpx RHEL 8 1.7.0-10.el8_8
- libvpx RHEL 9 1.9.0-7.el9_2
- firefox RHEL 8 115.3.1-1.el8_8
- thunderbird RHEL 8 115.3.1-1.el8_8
- thunderbird RHEL 7 115.3.1-1.el7_9
- firefox RHEL 7 115.3.1-1.el7_9
- thunderbird RHEL 9 115.3.1-1.el9_2
- firefox RHEL 9 115.3.1-1.el9_2
red hat advisories RHSA-2023:5537RHSA-2023:5535RHSA-2023:5538RHSA-2023:5539RHSA-2023:5534RHSA-2023:5536
- MozillaThunderbird SLE Workstation Extension 15 SP5, SLE Workstation Extension 15 SP4, SLE Module for Package Hub 15 SP5 +3 more 115.3.1-150200.8.133.1
- MozillaFirefox SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 115.3.1-112.185.1
- MozillaFirefox SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +9 more 115.3.1-150200.152.111.1
- libvpx SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +13 more 1.6.1-150000.6.11.1
- libvpx SLE Module for Package Hub 15 SP5, SLE Module for Package Hub 15 SP4, SLE Module for Basesystem 15 SP5 +3 more 1.11.0-150400.3.3.1
- libvpx SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +1 more 1.3.0-3.12.1
- MozillaFirefox SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 115.3.1-150000.150.110.1
suse advisories SUSE-SU-2023:4016-1SUSE-SU-2023:3950-1SUSE-SU-2023:3949-1SUSE-SU-2023:3948-1SUSE-SU-2023:3946-1SUSE-SU-2023:3941-1
- firefox-esr openSUSE Tumbleweed 128.5.1-1.1
- chromium openSUSE Tumbleweed 117.0.5938.132-1.1
- MozillaFirefox openSUSE Tumbleweed 118.0.1-1.1
- libvpx openSUSE Tumbleweed 1.13.0-2.1
- MozillaThunderbird openSUSE Tumbleweed 115.3.1-1.1
- nodejs-electron openSUSE Tumbleweed 25.8.4-2.1
- vlc openSUSE Tumbleweed 3.0.19-1.1
- element-desktop openSUSE Tumbleweed 1.11.47-1.1
opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:13269-1openSUSE-SU-2024:13272-1openSUSE-SU-2024:13274-1openSUSE-SU-2024:13276-1openSUSE-SU-2024:13277-1
- libvpx AlmaLinux 8 1.7.0-10.el8_8.alma.1
- libvpx AlmaLinux 9 1.9.0-7.el9_2.alma.1
- firefox AlmaLinux 9 115.3.1-1.el9_2.alma.1
- firefox-x11 AlmaLinux 9 115.3.1-1.el9_2.alma.1
- thunderbird AlmaLinux 9 115.3.1-1.el9_2.alma
almalinux advisories ALSA-2023:5537ALSA-2023:5539ALSA-2023:5434ALSA-2023:5435
- libvpx Rocky Linux 8 1.7.0-10.el8_8
- thunderbird Rocky Linux 9 115.3.1-1.el9_2
- thunderbird Rocky Linux 8 115.3.1-1.el8_8
rocky linux advisories RLSA-2023:5537RLSA-2023:5435RLSA-2023:5428
- libvpx Alpine 3.17 1.12.0-r2
- libvpx Alpine 3.18 1.13.0-r2
- libvpx Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.13.0-r3
- firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +3 more 115.3.1-r0
- qt5-qtwebengine Alpine 3.18 5.15.13-r9
- qt5-qtwebengine Alpine 3.23, Alpine 3.22, Alpine 3.21 +2 more 5.15.15-r3
alpine advisories ALPINE-CVE-2023-5217
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/webmproject/libvpx@3fbd1dc commit
- github.com/webmproject/libvpx@af6dedd commit
- github.com/electron/electron#40022 pull request
- github.com/electron/electron#40023 pull request
- github.com/electron/electron#40024 pull request
- github.com/electron/electron#40025 pull request
- github.com/electron/electron#40026 pull request
- github.com/webmproject/libvpx/releases/tag/v1.13.1 release
- github.com/electron/electron/releases/tag/v22.3.25 release
- github.com/electron/electron/releases/tag/v24.8.5 release
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-5217 updated cvss 8.8
libvpx: Heap buffer overflow in vp8 encoding in libvpx
-
Red Hat Enterprise Linux 6 libvpx, libvpx-utilsaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbirdaffected: workaround, no fix available
-
Red Hat CodeReady Linux Builder EUS (v.8.6) libvpx-devel 1.7.0-10.el8_6, libvpx-debuginfo 1.7.0-10.el8_6, libvpx-debugsource 1.7.0-10.el8_6, libvpx-utils-debuginfo 1.7.0-10.el8_6fixed: vendor fix RHSA-2023:5538
-
Red Hat CodeReady Linux Builder EUS (v.9.0) libvpx-devel 1.9.0-7.el9_0, libvpx-debuginfo 1.9.0-7.el9_0, libvpx-debugsource 1.9.0-7.el9_0, libvpx-utils-debuginfo 1.9.0-7.el9_0fixed: vendor fix RHSA-2023:5540
-
Red Hat Enterprise Linux AppStream (v. 8) libvpx 1.7.0-10.el8_8, firefox 115.3.1-1.el8_8, thunderbird 115.3.1-1.el8_8fixed: vendor fix RHSA-2023:5433
-
Red Hat Enterprise Linux AppStream (v. 9) libvpx 1.9.0-7.el9_2, firefox 115.3.1-1.el9_2, firefox-x11 115.3.1-1.el9_2, thunderbird 115.3.1-1.el9_2fixed: vendor fix RHSA-2023:5434
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) libvpx 1.7.0-8.el8_2, firefox 115.3.1-1.el8_2, thunderbird 115.3.1-1.el8_2fixed: vendor fix RHSA-2023:5426
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) libvpx 1.7.0-10.el8_4, firefox 115.3.1-1.el8_4, thunderbird 115.3.1-1.el8_4fixed: vendor fix RHSA-2023:5437
show 12 moreshow fewer
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) libvpx 1.7.0-8.el8_1, firefox 115.3.1-1.el8_1, thunderbird 115.3.1-1.el8_1fixed: vendor fix RHSA-2023:5440
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) libvpx 1.7.0-8.el8_2, firefox 115.3.1-1.el8_2, thunderbird 115.3.1-1.el8_2fixed: vendor fix RHSA-2023:5426
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) libvpx 1.7.0-10.el8_4, firefox 115.3.1-1.el8_4, thunderbird 115.3.1-1.el8_4fixed: vendor fix RHSA-2023:5437
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) libvpx 1.7.0-10.el8_6, firefox 115.3.1-1.el8_6, thunderbird 115.3.1-1.el8_6fixed: vendor fix RHSA-2023:5436
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) libvpx 1.9.0-7.el9_0, firefox 115.3.1-1.el9_0, thunderbird 115.3.1-1.el9_0fixed: vendor fix RHSA-2023:5427
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) libvpx 1.7.0-8.el8_2, firefox 115.3.1-1.el8_2, thunderbird 115.3.1-1.el8_2fixed: vendor fix RHSA-2023:5426
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) libvpx 1.7.0-10.el8_4, firefox 115.3.1-1.el8_4, thunderbird 115.3.1-1.el8_4fixed: vendor fix RHSA-2023:5437
-
Red Hat Enterprise Linux Client (v. 7) firefox 115.3.1-1.el7_9, thunderbird 115.3.1-1.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) firefox 115.3.1-1.el7_9fixed: vendor fix RHSA-2023:5477
-
Red Hat Enterprise Linux CRB (v. 8) libvpx-devel 1.7.0-10.el8_8, libvpx-debuginfo 1.7.0-10.el8_8, libvpx-debugsource 1.7.0-10.el8_8, libvpx-utils-debuginfo 1.7.0-10.el8_8fixed: vendor fix RHSA-2023:5537
-
Red Hat Enterprise Linux CRB (v. 9) libvpx-devel 1.9.0-7.el9_2, libvpx-debuginfo 1.9.0-7.el9_2, libvpx-debugsource 1.9.0-7.el9_2, libvpx-utils-debuginfo 1.9.0-7.el9_2fixed: vendor fix RHSA-2023:5539
-
Red Hat Enterprise Linux Server (v. 7) firefox 115.3.1-1.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) firefox 115.3.1-1.el7_9, thunderbird 115.3.1-1.el7_9 Red Hat Enterprise Linux Workstation (v. 7) firefox 115.3.1-1.el7_9, thunderbird 115.3.1-1.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 115.3.1-1.el7_9fixed: vendor fix RHSA-2023:5477
-
Red Hat Enterprise Linux 7 libvpx, libvpx-utilsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-25-203-04 updated cvss 8.8
Schneider Electric EcoStruxure Power Operation (Update A)
-
Schneider Electric EcoStruxure Power Operation (EPO) 2022 <=CU6 Schneider Electric EcoStruxure Power Operation (EPO) 2024 <=CU1affected: mitigation “If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:” community.se.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Timeline
- Found exploited as a 0-day (Project Zero)
- 0-day patched (Project Zero)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 3 y ago
- Patch by
- 2023-10-23 (3 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Google, Chromium libvpx
- CISA name
- Google Chromium libvpx Heap Buffer Overflow Vulnerability
Zero-day
Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.
- Found
- 2023-09-25
- Patched
- 2023-09-27
- Details
- project zero tracker
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
49.01% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- crbug.com https://crbug.com/1486441 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <22.3.25 >=24.0.0, <24.8.5 >=25.0.0, <25.8.4 >=26.0.0, <26.2.4 >=27.0.0-alpha.1, <27.0.0-beta.8 |
22.3.25 24.8.5 25.8.4 26.2.4 27.0.0-beta.8 |
| julia | LibVPX_jll | <1.15.2+0 |
1.15.2+0 |
Affected products
- Google Chrome
- Google libvpx
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
- Technology feeds
References
-
github.com
/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
web, patch
-
github.com
/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
web, patch
-
openwall.com
/lists/oss-security/2023/09/28/5
mailing-list, patch, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/28/6
mailing-list, patch, third-party-advisory, web
-
github.com
/electron/electron/pull/40022
web
-
github.com
/electron/electron/pull/40023
web
-
github.com
/electron/electron/pull/40024
web
-
github.com
/electron/electron/pull/40025
web
-
github.com
/electron/electron/pull/40026
web
-
crbug.com
/1486441
web, exploit, issue-tracking
-
chromereleases.googleblog.com
/2023/09/stable-channel-update-for-desktop_27.html
web, vendor-advisory
-
openwall.com
/lists/oss-security/2023/09/29/1
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/29/2
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/29/7
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/29/9
mailing-list, third-party-advisory, web
- mozilla.org /en-US/security/advisories/mfsa2023-44/
-
security-tracker.debian.org
/tracker/CVE-2023-5217
web
-
bugzilla.redhat.com
/show_bug.cgi?id=2241191
web, issue-tracking, third-party-advisory
- stackdiary.com /google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/
-
openwall.com
/lists/oss-security/2023/09/28/5
web
-
pastebin.com
/TdkC4pDv
web, not-applicable
-
github.com
/webmproject/libvpx/tags
web, product
-
openwall.com
/lists/oss-security/2023/09/29/11
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/29/12
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/29/14
mailing-list, third-party-advisory, web
-
debian.org
/security/2023/dsa-5510
web
-
debian.org
/security/2023/dsa-5509
web
-
debian.org
/security/2023/dsa-5508
web
-
openwall.com
/lists/oss-security/2023/09/30/1
mailing-list, third-party-advisory, web
-
lists.debian.org
/debian-lts-announce/2023/09/msg00038.html
web, mailing-list
-
twitter.com
/maddiestone/status/1707163313711497266
web
-
arstechnica.com
/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/
third-party-advisory, web
-
github.com
/webmproject/libvpx/releases/tag/v1.13.1
web, release-notes
-
openwall.com
/lists/oss-security/2023/09/30/3
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/30/2
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/30/4
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/09/30/5
mailing-list, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/
mailing-list, web
-
openwall.com
/lists/oss-security/2023/10/01/2
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/10/01/1
mailing-list, third-party-advisory, web
-
openwall.com
/lists/oss-security/2023/10/01/5
mailing-list, third-party-advisory, web
-
lists.debian.org
/debian-lts-announce/2023/10/msg00001.html
web, mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
mailing-list, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/
mailing-list, web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2023-5217
advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I
web
-
security.gentoo.org
/glsa/202310-04
web
-
security.gentoo.org
/glsa/202401-34
web
-
stackdiary.com
/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217
web
-
support.apple.com
/kb/HT213961
web
-
support.apple.com
/kb/HT213972
web
-
mozilla.org
/en-US/security/advisories/mfsa2023-44
web
-
arstechnica.com
/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software
web
-
github.com
/electron/electron
package
-
github.com
/electron/electron/releases/tag/v22.3.25
web
-
github.com
/electron/electron/releases/tag/v24.8.5
web
Sources
- CVE List CVE-2023-5217
- GitHub Advisory GHSA-qqvq-6xgj-jw8g
- NVD CVE-2023-5217
- OSV JLSEC-2026-375
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.