Medium severity · published Dec 2, 2020
CVE-2020-13494
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files
5.5
CVSS
1.2%
EPSS
No
On KEV
Description
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, victim needs to access an attacker-provided malformed file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openusd · Pixar
20.05 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13494
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1103
More from Openusd
8.8
CVE-2020-13531
A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files
7.8
CVE-2020-13520
An out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 reconstructs paths from binary USD files
7.8
CVE-2020-13493
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files
7.8
CVE-2020-6156
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files
7.8
CVE-2020-6155
A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files