CVE-2020-5986

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x (prior to 8.5), version 10.x (prior to 10.4) and version 11.0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
NVIDIA	NVIDIA vGPU Software	vGPU version 8.x (prior to 8.5), version 10.x (prior to 10.4) and version 11.0.

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5075Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5075Vendor Advisory

Timeline

Published: Oct 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-59877.8NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which guest-supplied parameters remain writable by the guest after CVE-2020-59887.1NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which allocated memory can be freed twice, which may lead to info CVE-2020-59895.5NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it can dereference a NULL pointer, which may lead to denial CVE-2020-59907.8NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local pri CVE-2020-59917.8NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write op CVE-2020-59927.8NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software d CVE-2020-60077.9Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string CVE-2020-60089.8LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution CVE-2020-60099.8LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-60108.8LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection CVE-2020-60127.4ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed att CVE-2020-60138.8ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute co