CVE-2020-12886

Katalog CVE

CVSS 9.1 · Critical EPSS 1,4%

Kerentanan Out-of-bounds Read pada arm mbed os. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP packet header starting from the message token. The length of the token in the received message is provided in the first byte parsed by the sn_coap_parser_options_parse() function. The length encoded in the message is not validated against the actual input buffer length before accessing the token. As a result, memory access outside of the intended boundary of the buffer may occur.

Rincian

Terbit di NVD

18 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ARMmbed/mbed-coap/pull/116 advisory pihak ketiga
• https://github.com/ARMmbed/mbed-os/issues/12948 advisory pihak ketiga