Is CVE-2023-5217 exploited in the wild?

Yes. CVE-2023-5217 is known to be exploited in the wild, first recorded on 2 October 2023. Treat it as urgent.

How severe is CVE-2023-5217?

Critical severity, with a CVSS score of 3.1, published 28 September 2023.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=22.3.25.

Is there a fix for CVE-2023-5217?

Yes. electron (npm): upgrade to 22.3.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-5217 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-5217?

Check whether you run Google Chromium libvpx or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-5217: Electron heap buffer overflow in libvpx vp8 encoding

CVE-2023-5217 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2023-09-28

Electron, a widely-used framework for building desktop applications, uses the libvpx video encoding library which contains a heap buffer overflow vulnerability in VP8 encoding. An attacker can exploit this flaw by sending a specially crafted HTML page containing malicious video content, potentially allowing arbitrary code execution on a user's system.

Technologies: electron (npm). Vendors: Google, npm.

Quick answers

Is CVE-2023-5217 exploited in the wild?: Yes. CVE-2023-5217 is known to be exploited in the wild, first recorded on 2 October 2023. Treat it as urgent.
How severe is CVE-2023-5217?: Critical severity, with a CVSS score of 3.1, published 28 September 2023.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=22.3.25.
Is there a fix for CVE-2023-5217?: Yes. electron (npm): upgrade to 22.3.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-5217 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-5217?: Check whether you run Google Chromium libvpx or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 22.3.25 or later
```
npm install electron@22.3.25
```

Technical details

This is a heap buffer overflow vulnerability (CWE-787) in libvpx's VP8 encoding implementation, inherited by Electron which bundles the library. The vulnerability exists when handling malformed VP8-encoded video streams within web pages. An attacker can trigger heap corruption by crafting a malicious HTML page containing adversarial video content; this requires user interaction (loading or viewing the page in an Electron app) but no authentication. Successful exploitation can lead to arbitrary code execution with the privileges of the Electron application. Patches are available in Electron 22.3.25, 24.8.5, 25.8.4, 26.2.4, and 27.0.0-beta.8 or later, which update libvpx to version 1.13.1 or incorporate the necessary commit patches.

Affected products

OpenJS Foundation Electron versions prior to 22.3.25, 24.x prior to 24.8.5, 25.x prior to 25.8.4, 26.x prior to 26.2.4, and 27.x prior to 27.0.0-beta.8

Identifiers

CVE-2023-5217
GHSA-qqvq-6xgj-jw8g

Timeline

2023-09-28: disclosed
2023-09-28: patched: Electron patches released for multiple versions

References

https://github.com/electron/electron/pull/40022

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.