CVE-2023-5217

Confirmed PUBLISHED

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially...

Google · Chrome, libvpx

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.8 High

At a Glance

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

cisa nessus_scanner

CVE Published: Sep 28, 2023
Exploitation Reported: Oct 02, 2023
CVSS: 8.8 High
EPSS: —

Remote Low complexity Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Google	Chrome	117.0.5938.132 to < 117.0.5938.132	Affected
Google	libvpx	1.13.1 to < 1.13.1	Affected

CVE References

chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27... chromereleases.googleblog.com · CVE Record https://chromereleases.googleblog.com/2023/09/stable-channel-update-f...
crbug.com/1486441 crbug.com · CVE Record https://crbug.com/1486441
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/28/5
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/28/6
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/1

Show 47 more references

OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/2
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/7
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/9
mozilla.org/en-US/security/advisories/mfsa2023-44 mozilla.org · CVE Record https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/
security-tracker.debian.org/tracker/CVE-2023-5217 security-tracker.debian.org · CVE Record https://security-tracker.debian.org/tracker/CVE-2023-5217
bugzilla.redhat.com/show_bug.cgi bugzilla.redhat.com · CVE Record https://bugzilla.redhat.com/show_bug.cgi?id=2241191
stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-c... stackdiary.com · CVE Record https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve...
OSS-Security Mailing List openwall.com · CVE Record https://www.openwall.com/lists/oss-security/2023/09/28/5
pastebin.com/TdkC4pDv pastebin.com · CVE Record https://pastebin.com/TdkC4pDv
GitHub — webmproject/libvpx github.com · CVE Record https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110...
GitHub — webmproject/libvpx github.com · CVE Record https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944...
GitHub — webmproject/libvpx github.com · CVE Record https://github.com/webmproject/libvpx/tags
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/11
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/12
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/29/14
debian.org/security/2023/dsa-5510 debian.org · CVE Record https://www.debian.org/security/2023/dsa-5510
debian.org/security/2023/dsa-5509 debian.org · CVE Record https://www.debian.org/security/2023/dsa-5509
debian.org/security/2023/dsa-5508 debian.org · CVE Record https://www.debian.org/security/2023/dsa-5508
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/30/1
lists.debian.org/debian-lts-announce/2023/09/msg00038.html lists.debian.org · CVE Record https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html
twitter.com/maddiestone/status/1707163313711497266 twitter.com · CVE Record https://twitter.com/maddiestone/status/1707163313711497266
arstechnica.com/security/2023/09/new-0-day-in-chrome-and-fir... arstechnica.com · CVE Record https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-fire...
GitHub — webmproject/libvpx github.com · CVE Record https://github.com/webmproject/libvpx/releases/tag/v1.13.1
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/30/3
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/30/2
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/30/4
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/09/30/5
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/10/01/2
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/10/01/1
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/10/01/5
lists.debian.org/debian-lts-announce/2023/10/msg00001.html lists.debian.org · CVE Record https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/10/02/6
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2023/10/03/11
security.gentoo.org/glsa/202310-04 security.gentoo.org · CVE Record https://security.gentoo.org/glsa/202310-04
support.apple.com/kb/HT213961 support.apple.com · CVE Record https://support.apple.com/kb/HT213961
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
seclists.org/fulldisclosure/2023/Oct/12 seclists.org · CVE Record http://seclists.org/fulldisclosure/2023/Oct/12
lists.debian.org/debian-lts-announce/2023/10/msg00015.html lists.debian.org · CVE Record https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html
support.apple.com/kb/HT213972 support.apple.com · CVE Record https://support.apple.com/kb/HT213972
seclists.org/fulldisclosure/2023/Oct/16 seclists.org · CVE Record http://seclists.org/fulldisclosure/2023/Oct/16
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
security.gentoo.org/glsa/202401-34 security.gentoo.org · CVE Record https://security.gentoo.org/glsa/202401-34

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-10-02 00:00 UTC

CVSS Scores

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2023-10-02 00:00:00 UTC · CISA

Weaknesses (CWE)

CWE-787

Out-of-bounds Write

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/236224	Jun 02, 2025

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-5217

{
  "cve_id": "CVE-2023-5217",
  "title": "Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117....",
  "affected_vendor": "Google",
  "affected_product": "Chrome, libvpx",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-5217

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Timeline

Automate This Intelligence with the Pro API