CVE-2020-36403

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yamlThird Party Advisory
https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72cPatch, Third Party Advisory
https://github.com/samtools/htslib/pull/1447Exploit, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24097Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/htslib/OSV-2020-955.yamlThird Party Advisory
https://github.com/samtools/htslib/commit/dcd4b7304941a8832fba2d0fc4c1e716e7a4e72cPatch, Third Party Advisory
https://github.com/samtools/htslib/pull/1447Exploit, Third Party Advisory

Timeline

Published: Jul 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-364047.8Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.CVE-2020-364057.8Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.CVE-2020-364068.8uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). CVE-2020-364078.8libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.CVE-2020-364085.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364095.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-36419.8Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon CVE-2020-364105.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364115.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364125.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364135.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364145.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT