peter bassill · operator
$ cve CVE-2020-12460 JSON

CVE-2020-12460

9.8
CRITICAL · CVSS 3.1 · EPSS 3.7% (pctl 89)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS3.68% — more likely to be exploited than 89% of all CVEs
WeaknessCWE-787
On CISA KEVno
Public exploitnone known
Published2020-07-27
Last modified2026-06-17

Affected (3)

VendorProduct
debiandebian linux
fedoraprojectfedora
trusteddomainopendmarc

References

→ the Explorer  ·  watch your stack  ·  NVD