CVE-2020-0478
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing...
CVE-2020-0478 is a high vulnerability (CVSS 7.8) in Google Android, published December 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in aom 1.0.0.errata1.avif-1.
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
CVE-2020-0478- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
CVE-2020-0478- Updated
- 2026-11-02
EUVDEUVD-2020-1976 No score
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
EUVD-2020-1976- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vw67-8g5q-g6f3 No score
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing...
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
GHSA-vw67-8g5q-g6f3- Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
CVE-2020-0478- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-0478
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150780418
- Record
DEBIAN-CVE-2020-0478- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2020-0478 No score
CVE-2020-0478 in aom - Patched by Root
Root has patched CVE-2020-0478 in the aom package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2020-0478- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aomDebian:12 |
before 1.0.0.errata1.avif-1 | 1.0.0.errata1.avif-1 |
aomDebian:13 |
before 1.0.0.errata1.avif-1 | 1.0.0.errata1.avif-1 |
aomDebian:14 |
before 1.0.0.errata1.avif-1 | 1.0.0.errata1.avif-1 |
aomRoot:Debian:11 |
before 1.0.0.errata1-3+deb11u2.root.io.9 | 1.0.0.errata1-3+deb11u2.root.io.91.0.0.errata1-3+deb11u2.root.io.41.0.0.errata1-3+deb11u2.root.io.51.0.0.errata1-3+deb11u2.root.io.31.0.0.errata1-3+deb11u2.root.io.61.0.0.errata1-3+deb11u2.root.io.71.0.0.errata1-3+deb11u2.aikido.101.0.0.errata1-3+deb11u2.root.io.8 |
rootio-aomRoot:Debian:11 |
before 1.0.0.errata1-3+deb11u2.root.io.9 | 1.0.0.errata1-3+deb11u2.root.io.91.0.0.errata1-3+deb11u2.root.io.41.0.0.errata1-3+deb11u2.root.io.51.0.0.errata1-3+deb11u2.root.io.31.0.0.errata1-3+deb11u2.root.io.61.0.0.errata1-3+deb11u2.root.io.71.0.0.errata1-3+deb11u2.aikido.101.0.0.errata1-3+deb11u2.root.io.8 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |