CVE-2020-23886

low-risk
Published 2021-11-10

XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict file. Related to a User Mode Write AV starting at ntdll!RtlpLowFragHeapFree.

Do I need to act?

-
0.26% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Xnview Mp

Affected Vendors

Xnview

References (6)

Technical Description https://cwe.mitre.org/data/definitions/122.html
Exploit https://github.com/Aurorainfinity/vulnerabilities/tree/master/xnviewmp
Product https://www.xnview.com/en/xnviewmp/
Technical Description https://cwe.mitre.org/data/definitions/122.html
Exploit https://github.com/Aurorainfinity/vulnerabilities/tree/master/xnviewmp
Product https://www.xnview.com/en/xnviewmp/
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal