cyfenced.com →

[ CVE-2023-5217 · Published 28 Sep 2023 ]

Google Chromium libvpx Heap Buffer Overflow Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 49%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-10-02
  • EPSS: 49% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CISA: Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 23 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References