{"id":"CVE-2020-15999","aliases":["A-171232105","ASB-A-171232105","GHSA-pv36-h7jh-qm62"],"url":"https://o3.security/vulnerability/CVE-2020-15999","summary":"Heap buffer overflow in CefSharp","details":"### Impact\nA memory corruption bug(Heap overflow) in the FreeType font rendering library.\n\n> This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .\n\nAs per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ \n\nGoogle is aware of reports that an exploit for CVE-2020-15999 exists in the wild.\n\n### Patches\nUpgrade to 85.3.130 or higher\n\n### References\n- https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/\n- https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/\n- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999\n- https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942\n\nTo review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d","published":"2020-11-03T03:15:14.853Z","modified":"2026-10-24T10:30:15.104798405Z","cvss":{"score":9.6,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},"epss":{"score":0.44303,"percentile":0.98692,"asOf":"2026-09-16"},"cisaKev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":false},"exploitsKnown":7,"affectedPackages":[{"ecosystem":"NuGet","name":"CefSharp.Common","fixedVersion":"85.3.130"},{"ecosystem":"NuGet","name":"CefSharp.Wpf","fixedVersion":"85.3.130"},{"ecosystem":"NuGet","name":"CefSharp.WinForms","fixedVersion":"85.3.130"},{"ecosystem":"NuGet","name":"CefSharp.Wpf.HwndHost","fixedVersion":"85.3.130"}],"fix":null,"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html"},{"type":"ADVISORY","url":"http://seclists.org/fulldisclosure/2020/Nov/33"},{"type":"ADVISORY","url":"https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202011-12"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202012-04"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202401-19"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240812-0001/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-4824"},{"type":"REPORT","url":"https://crbug.com/1139963"},{"type":"EVIDENCE","url":"https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html"},{"type":"WEB","url":"https://github.com/cefsharp/CefSharp/security/advisories/GHSA-pv36-h7jh-qm62"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15999"},{"type":"WEB","url":"https://www.nuget.org/packages/CefSharp.Wpf.HwndHost"},{"type":"WEB","url":"https://www.nuget.org/packages/CefSharp.Wpf"},{"type":"WEB","url":"https://www.nuget.org/packages/CefSharp.WinForms"},{"type":"WEB","url":"https://www.nuget.org/packages/CefSharp.Common"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240812-0001"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7"},{"type":"PACKAGE","url":"https://github.com/cefsharp/CefSharp"}],"provenance":{"sources":["OSV.dev","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:15.104798405Z"}}