CVE-2020-36430

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-364315.5Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_arm.CVE-2020-364329.8An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().CVE-2020-364337.5An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.CVE-2020-364349.8An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.CVE-2020-364358.1An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust. In Singleton, Send and Sync do not have bounds checks.CVE-2020-364368.1An issue was discovered in the unicycle crate before 0.7.1 for Rust. PinSlab<T> and Unordered<T, S> do not have bounds on their Send and SynCVE-2020-364378.1An issue was discovered in the conqueue crate before 0.4.0 for Rust. There are unconditional implementations of Send and Sync for QueueSendeCVE-2020-364388.1An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future<T> does not have bounds on its Send and Sync traits.CVE-2020-364398.1An issue was discovered in the ticketed_lock crate before 0.3.0 for Rust. There are unconditional implementations of Send for ReadTicket<T> CVE-2020-36445.5u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display session' in SnapdragoCVE-2020-364408.1An issue was discovered in the libsbc crate before 0.1.5 for Rust. For Decoder<R>, it implements Send for any R: Read.CVE-2020-364418.1An issue was discovered in the abox crate before 0.4.1 for Rust. It implements Send and Sync for AtomicBox<T> with no requirement for T: Sen
CVE-2020-36430: High severity, CVSS 7.8 | Vulnix