CVE-2020-36430

    Dashboard / Vulnerabilities / CVE-2020-36430

    CVE-2020-36430

    Published: 20 Jul 2021Last Modified: 8 Jul 2026

    Summary:

    Details: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JUXFQUJ32GWG5E46A63DFDCYJAF3VU6/, https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml, https://security.gentoo.org/glsa/202208-13, https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674, https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d149636f502f5774ae1a8fb4c554b122674393b2
    Fixed -5447214643eacef71776350e779adf4b6c07bb3b

    Affected versions

    0.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-36430 | CVE-DB