Actively exploited in the wild
Google Chromium libvpx Heap Buffer Overflow Vulnerability
Google - Chromium libvpx · Listed in the CISA KEV since 2023-10-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-5217
HighCVSS 8.8KEVSummary
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
A remote attacker could cause memory corruption and potentially execute arbitrary code in the browser context. This may lead to data theft or further system compromise.
Recommendation
Update Google Chrome to version 117.0.5938.132 or later and libvpx to version 1.13.1 or later. Avoid visiting untrusted websites.
Other vulnerabilities in libvpx
Original NVD description (English source)
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)