CVE-2023-5217
HIGH KEVlibvpx < 1.13.1 - Heap Buffer Overflow in VP8 Encoding
Title source: llmExploitation Summary
CVE-2023-5217 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 2, 2023. EIP tracks 4 public exploits from researchers including UT-Security, Trinadh465.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2023-5217, a heap buffer overflow in libvpx VP8 encoding. The exploit leverages the WebCodecs and MediaRecorder APIs to trigger the vulnerability in browsers, allowing controlled heap overflows.
Description
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Exploits (4)
This repository contains a proof-of-concept for CVE-2023-5217, a heap buffer overflow in libvpx VP8 encoding. The exploit leverages the WebCodecs and MediaRecorder APIs to trigger the vulnerability in browsers, allowing controlled heap overflows.
The repository appears to be a partial or incomplete snapshot of the libvpx library (version 1.4.0) with no explicit exploit code for CVE-2023-5217. The provided files are primarily build scripts, examples, and utility code, lacking a clear PoC or exploit implementation.
The repository appears to be a partial or incomplete snapshot of the libvpx library (version 1.8.0) with a README and a single source file (args.c). No exploit code or proof-of-concept for CVE-2023-5217 is present in the provided files.
This repository contains a functional PoC for CVE-2023-5217, a heap buffer overflow in libvpx VP8 encoding. The exploit leverages WebCodecs and MediaRecorder APIs to trigger the vulnerability by manipulating frame dimensions and thread counts.
References (53)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H