CVE-2020-23886

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict file. Related to a User Mode Write AV starting at ntdll!RtlpLowFragHeapFree.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cwe.mitre.org/data/definitions/122.htmlTechnical Description
https://github.com/Aurorainfinity/vulnerabilities/tree/master/xnviewmpExploit, Third Party Advisory
https://www.xnview.com/en/xnviewmp/Product, Vendor Advisory
https://cwe.mitre.org/data/definitions/122.htmlTechnical Description
https://github.com/Aurorainfinity/vulnerabilities/tree/master/xnviewmpExploit, Third Party Advisory
https://www.xnview.com/en/xnviewmp/Product, Vendor Advisory

Timeline

Published: Nov 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020