CVE-2023-5217

87

FAUCET Score

CVE-2023-5217 is a critical heap buffer overflow vulnerability in the libvpx VP8 encoding library, affecting numerous products including Google Chrome, Apple, Debian, and Microsoft. This high-severity vulnerability (CVSS 8.8) can be exploited remotely with low complexity via a crafted HTML page, potentially leading to full compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog, and has garnered significant community discussion and media coverage, despite a lack of public exploit code.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.13.1CPE matchmatch criteria	cpe:2.3:a:webmproject:libvpx::::::::
		116.0.1938.98CPE matchmatch criteria	cpe:2.3:a:microsoft:edge:116.0.1938.98:::::::*
		117.0.2045.47CPE matchmatch criteria	cpe:2.3:a:microsoft:edge:117.0.2045.47:::::::*
		116.0.5845.229CPE matchmatch criteria	cpe:2.3:a:microsoft:edge_chromium:116.0.5845.229:::::::*
		117.0.5938.132CPE matchmatch criteria	cpe:2.3:a:microsoft:edge_chromium:117.0.5938.132:::::::*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

49.01%

Probability of exploitation in next 30 days

EPSS Percentile

98.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

Added to KEV · Oct 2, 2023

This CVE's current EPSS score of 0.4901 is in the 99th percentile among its peer group of 14,848 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (47)

github_advisorypatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: Microsoft Teams for Mac, Classic EditionFixed in: 1.6.00.27656

microsoftpatch availablevia msrc

Product: Microsoft Teams for DesktopFixed in: 1.6.00.27573

microsoftpatch availablevia msrc

Product: Microsoft Edge (Chromium-based)Fixed in: 116.0.1938.98

npmpatch availablevia ghsa

Product: electronFixed in: 25.8.4

npmpatch availablevia ghsa

Product: electronFixed in: 24.8.5

npmpatch availablevia ghsa

Product: electronFixed in: 27.0.0-beta.8

npmpatch availablevia ghsa

Product: electronFixed in: 22.3.25

npmpatch availablevia ghsa

Product: electronFixed in: 26.2.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: firefox-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: thunderbird-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: libvpx-0:1.7.0-8.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: firefox-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: thunderbird-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: libvpx-0:1.7.0-8.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: firefox-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: thunderbird-0:115.3.1-1.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: libvpx-0:1.7.0-8.el8_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: thunderbird-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: firefox-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: libvpx-0:1.7.0-10.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: thunderbird-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: firefox-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: libvpx-0:1.7.0-10.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: thunderbird-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: firefox-0:115.3.1-1.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: libvpx-0:1.7.0-10.el8_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: thunderbird-0:115.3.1-1.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: firefox-0:115.3.1-1.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: libvpx-0:1.7.0-10.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: firefox-0:115.3.1-1.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: thunderbird-0:115.3.1-1.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: libvpx-0:1.9.0-7.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: firefox-0:115.3.1-1.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: thunderbird-0:115.3.1-1.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: libvpx-0:1.9.0-7.el9_0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: thunderbird-0:115.3.1-1.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: firefox-0:115.3.1-1.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: thunderbird-0:115.3.1-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: firefox-0:115.3.1-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: libvpx-0:1.7.0-10.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: thunderbird-0:115.3.1-1.el8_1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: firefox-0:115.3.1-1.el8_1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: libvpx-0:1.7.0-8.el8_1

googlevendor investigatingvia nvd_reference

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: thunderbird:flatpak/thunderbird

redhatno patchvia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: firefox:flatpak/firefox

Vendor Advisories (3)

npmGHSA-qqvq-6xgj-jw8ghigh

Electron affected by libvpx's heap buffer overflow in vp8 encoding

redhatCVE-2023-5217Important

libvpx: Heap buffer overflow in vp8 encoding in libvpx

microsoft2023-Sep/CVE-2023-5217

Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx

References

cisa.gov / known-exploited-vulnerabilities-catalog

US Government Resource

arstechnica.com / security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory

chromereleases.googleblog.com / 2023/09/stable-channel-update-for-desktop_27.html

Vendor Advisory

crbug.com / 1486441

ExploitIssue Tracking

seclists.org / fulldisclosure/2023/Oct/12

Mailing ListThird Party Advisory

seclists.org / fulldisclosure/2023/Oct/16

Mailing ListThird Party Advisory

github.com / webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590

Patch

github.com / webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282

Patch

github.com / webmproject/libvpx/releases/tag/v1.13.1

Release Notes

github.com / webmproject/libvpx/tags

Product

lists.debian.org / debian-lts-announce/2023/09/msg00038.html

Mailing List

lists.debian.org / debian-lts-announce/2023/10/msg00001.html

Mailing List

lists.debian.org / debian-lts-announce/2023/10/msg00015.html

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB

Mailing List

lists.fedoraproject.org / archives/list/[email protected]/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I

Mailing List

pastebin.com / TdkC4pDv

Not Applicable

security.gentoo.org / glsa/202310-04

Third Party Advisory

security.gentoo.org / glsa/202401-34

Third Party Advisory

security-tracker.debian.org / tracker/CVE-2023-5217

Third Party Advisory

stackdiary.com / google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217

Third Party Advisory

support.apple.com / kb/HT213961

Third Party Advisory

support.apple.com / kb/HT213972

Third Party Advisory

twitter.com / maddiestone/status/1707163313711497266

Third Party Advisory

debian.org / security/2023/dsa-5508

Mailing List

debian.org / security/2023/dsa-5509

Mailing List

debian.org / security/2023/dsa-5510

Mailing List

mozilla.org / en-US/security/advisories/mfsa2023-44

Third Party Advisory

openwall.com / lists/oss-security/2023/09/28/5

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/28/5

Mailing ListPatchThird Party Advisory

openwall.com / lists/oss-security/2023/09/28/6

Mailing ListPatchThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/1

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/11

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/12

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/14

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/2

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/7

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/29/9

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/30/1

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/30/2

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/30/3

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/30/4

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/09/30/5

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/10/01/1

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/10/01/2

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/10/01/5

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/10/02/6

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2023/10/03/11

Mailing ListThird Party Advisory