CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2023-5217
High (8.8) in Google Chromium libvpx. In CISA KEV since 2023-10-02. EPSS 49% chance of exploitation in the next 30 days. Fixed in electron 22.3.25, 24.8.5, 25.8.4.
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity
- EPSS
- 49% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-10-02, due 2023-10-23
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:ipados
- apple:iphone_os
- debian:debian_linux
- fedoraproject:fedora
- google:chrome
- microsoft:edge
- microsoft:edge_chromium
- mozilla:firefox
- mozilla:thunderbird
- redhat:enterprise_linux
- webmproject:libvpx
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qqvq-6xgj-jw8g | npm | electron | <22.3.25 | 22.3.25 |
| GHSA-qqvq-6xgj-jw8g | npm | electron | >=24.0.0 <24.8.5 | 24.8.5 |
| GHSA-qqvq-6xgj-jw8g | npm | electron | >=25.0.0 <25.8.4 | 25.8.4 |
| GHSA-qqvq-6xgj-jw8g | npm | electron | >=26.0.0 <26.2.4 | 26.2.4 |
| GHSA-qqvq-6xgj-jw8g | npm | electron | >=27.0.0-alpha.1 <27.0.0-beta.8 | 27.0.0-beta.8 |