First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2020-36407

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-364085.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364095.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-36419.8Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon CVE-2020-364105.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364115.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364125.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364135.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364145.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364155.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-364165.4A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT CVE-2020-36427.8Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of CVE-2020-364207.5Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header.

CVE-2020-36407: High severity, CVSS 8.8 | Vulnix