CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Description
CVE-2023-5217 is a heap buffer overflow vulnerability in the VP8 encoding functionality of libvpx, a widely used open-source video codec library. The flaw affects Google Chrome prior to version 117.0.5938.132 and libvpx prior to version 1.13.1, as well as numerous other products that incorporate libvpx, including Mozilla Firefox, Microsoft Edge, Apple iOS and iPadOS, and various Linux distributions. A remote attacker can exploit CVE-2023-5217 by crafting a malicious HTML page to trigger heap corruption, potentially achieving arbitrary code execution on the victim's system. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 3.5% (87th percentile), organizations should urgently update all affected browsers and applications.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| webmproject | libvpx | < 1.13.1 |
| microsoft | edge | 116.0.1938.98; 117.0.2045.47 |
| microsoft | edge chromium | 116.0.5845.229; 117.0.5938.132 |
| mozilla | firefox | < 115.3.1; < 118.0.1; < 118.1 |
| mozilla | thunderbird | < 115.3.1 |
| fedoraproject | fedora | 37; 38; 39 |
| debian | debian linux | 10.0; 11.0; 12.0 |
| apple | ipados | >= 17.0, < 17.0.3; 16.7 |
| apple | iphone os | >= 17.0, < 17.0.3; 16.7 |
| chrome | < 117.0.5938.132 | |
| redhat | enterprise linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2023/Oct/12(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Oct/16(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/28/5(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/28/6(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/11(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/12(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/14(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/7(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/29/9(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/30/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/30/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/30/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/30/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/09/30/5(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/01/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/01/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/01/5(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/02/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/03/11(Mailing List, Third Party Advisory)
- https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2241191(Issue Tracking, Third Party Advisory)
- https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html(Vendor Advisory)
- https://crbug.com/1486441(Exploit, Issue Tracking)
- https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590(Patch)
- https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282(Patch)
- https://github.com/webmproject/libvpx/releases/tag/v1.13.1(Release Notes)
- https://github.com/webmproject/libvpx/tags(Product)
- https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/(Mailing List)
- https://pastebin.com/TdkC4pDv(Not Applicable)
- https://security-tracker.debian.org/tracker/CVE-2023-5217(Third Party Advisory)
- https://security.gentoo.org/glsa/202310-04(Third Party Advisory)
- https://security.gentoo.org/glsa/202401-34(Third Party Advisory)
- https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/(Third Party Advisory)
- https://support.apple.com/kb/HT213961(Third Party Advisory)
- https://support.apple.com/kb/HT213972(Third Party Advisory)
- https://twitter.com/maddiestone/status/1707163313711497266(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5508(Mailing List)
- https://www.debian.org/security/2023/dsa-5509(Mailing List)
- https://www.debian.org/security/2023/dsa-5510(Mailing List)
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/(Third Party Advisory)
- https://www.openwall.com/lists/oss-security/2023/09/28/5(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
An out-of-bounds write vulnerability occurs when a program writes data past the boundaries of an allocated memory buffer, potentially corrupting adjacent memory and enabling arbitrary code execution. In CVE-2023-5217, the libvpx VP8 encoder fails to properly validate buffer boundaries during video encoding operations, allowing a specially crafted input to trigger a heap buffer overflow that corrupts memory beyond the intended allocation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-5217 carries a CVSS 3.1 score of 8.8 (High severity), reflecting a severe and broadly exploitable vulnerability. The attack vector is network-based, meaning the vulnerability is remotely exploitable without physical access — an attacker simply needs to lure a victim to a crafted web page. The attack complexity is low, requiring no special conditions or preparation beyond hosting the malicious content. No authentication or privileges are required from the attacker, though user interaction is needed in the form of visiting the malicious page. Confidentiality (High): Successful exploitation through heap corruption can allow an attacker to read arbitrary memory contents, potentially exposing sensitive data such as session tokens, credentials, or personal information. Integrity (High): The heap buffer overflow enables arbitrary code execution, allowing the attacker to modify data, install malware, or alter system behavior. Availability (High): Exploitation can cause application crashes or enable the attacker to disrupt system operations entirely. The broad impact across Google Chrome, Mozilla Firefox, Microsoft Edge, Apple iOS/iPadOS, and multiple Linux distributions makes CVE-2023-5217 an exceptionally high-priority vulnerability for remediation.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-5217 in the wild by adding it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 23, 2023. Public exploit code is available for CVE-2023-5217 via Chromium Bug Tracker, which contains the original issue report and exploit details. The EPSS score of 3.5% places this vulnerability in the 87th percentile, indicating a notably elevated likelihood of exploitation. While the ransomware association is currently listed as unknown, the combination of confirmed active exploitation, public exploit availability, and the massive attack surface across all major browsers and operating systems makes this a critical-priority vulnerability requiring immediate action.
Remediation
- Update all affected browsers and applications immediately as directed by the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update Google Chrome to version 117.0.5938.132 or later, and apply the latest security updates for Mozilla Firefox, Microsoft Edge, and Thunderbird.
- Patch libvpx to version 1.13.1 or later on all systems where it is installed as a standalone library. Review the libvpx 1.13.1 release for the specific fixes addressing CVE-2023-5217.
- Update Apple devices to iOS 16.7, iPadOS 16.7, or later, and apply macOS security updates as referenced in Apple's support articles HT213961 and HT213972.
- Apply Linux distribution security patches for Debian, Fedora, Red Hat Enterprise Linux, and Gentoo by updating libvpx, Chromium, and Firefox packages through your distribution's package manager. Consult your distribution's security tracker for the specific advisory.
- Implement browser isolation and content filtering as interim mitigations to reduce exposure to malicious web pages. Deploy web application firewalls (WAFs) or content security policies that restrict untrusted media content, and enable browser auto-update mechanisms to ensure future patches are applied promptly.
Technical Details
CVE-2023-5217 is a heap buffer overflow (CWE-787, Out-of-bounds Write) in the VP8 encoding path of the libvpx library. The vulnerability occurs when the VP8 encoder processes specially crafted video input that causes a write operation to exceed the boundaries of a heap-allocated buffer, corrupting adjacent memory structures. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is network-accessible with low complexity — an attacker can trigger the overflow by embedding malicious VP8-encoded content in a web page, requiring only that the victim navigate to the page. The heap corruption can be leveraged to overwrite function pointers or other critical data structures, enabling arbitrary code execution within the context of the browser or application process. Because libvpx is embedded in virtually all major browsers (Chrome, Firefox, Edge) and operating systems (iOS, Android, Linux distributions), a single vulnerability in this library creates a cross-platform attack surface of exceptional breadth.
Frequently Asked Questions
Is CVE-2023-5217 being actively exploited?
Yes, CVE-2023-5217 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 23, 2023. Public exploit details are available through the Chromium bug tracker, and the widespread nature of the affected library makes this a high-priority threat.
What products are affected by CVE-2023-5217?
CVE-2023-5217 affects a wide range of products that use the libvpx library for VP8 video encoding. This includes Google Chrome (prior to 117.0.5938.132), Mozilla Firefox, Mozilla Thunderbird, Microsoft Edge (Chromium-based), Apple iOS and iPadOS, and multiple Linux distributions including Debian, Fedora, and Red Hat Enterprise Linux. The libvpx library itself is affected in versions prior to 1.13.1.
How do I fix CVE-2023-5217?
Update all affected browsers to their latest versions: Google Chrome 117.0.5938.132+, and the latest Mozilla Firefox, Thunderbird, and Microsoft Edge releases. For Apple devices, update to iOS/iPadOS 16.7 or later. On Linux systems, update libvpx, Chromium, and Firefox packages through your distribution's package manager. See the Remediation section for detailed steps.
How severe is CVE-2023-5217?
CVE-2023-5217 is rated High severity with a CVSS 3.1 score of 8.8. The vulnerability enables remote code execution through a crafted web page, with high impact on confidentiality, integrity, and availability. Its EPSS score of 3.5% (87th percentile) and confirmed active exploitation underscore the urgency to patch all affected software immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.