CVE-2020-11864
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
CVE-2020-11864- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
CVE-2020-11864- Updated
- 2026-11-02
EUVDEUVD-2020-4204 No score
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
EUVD-2020-4204- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pf4w-prfj-vwv2
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
GHSA-pf4w-prfj-vwv2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
CVE-2020-11864- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11864
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
DEBIAN-CVE-2020-11864- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2021-1376
libEMF security update
libEMF is designed to be used as a driver for other programs such as Grace and gunplot to generate Enhanced Metafiles on systems which don't natively support the ECMA-234 Graphics Device Interface (GDI). It implements a limited subset of GDI.
Security Fix(es):
ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a crafted EMF file.(CVE-2020-13999)
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 1 of 2).(CVE-2020-11863)
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access.(CVE-2020-11865)
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-after-free.(CVE-2020-11866)
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).(CVE-2020-11864)
- Record
OESA-2021-1376- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11864
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- Record
UBUNTU-CVE-2020-11864- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0831-1 No score
Security update for libEMF
This update for libEMF fixes the following issues:
- CVE-2020-11863: Fixed an issue which could have led to denial of service (bsc#1171496).
- CVE-2020-11864: Fixed an issue which could have led to denial of service (bsc#1171499).
- CVE-2020-11865: Fixed an out of bounds memory access (bsc#1171497).
- CVE-2020-11866: Fixed a use after free (bsc#1171498).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0831-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1621-1 No score
Security update for libEMF
This update for libEMF fixes the following issues:
- CVE-2020-11863: Fixed an issue which could have led to denial of service (bsc#1171496).
- CVE-2020-11864: Fixed an issue which could have led to denial of service (bsc#1171499).
- CVE-2020-11865: Fixed an out of bounds memory access (bsc#1171497).
- CVE-2020-11866: Fixed a use after free (bsc#1171498).
- Record
SUSE-SU-2020:1621-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1621-2 No score
Security update for libEMF
This update for libEMF fixes the following issues:
- CVE-2020-11863: Fixed an issue which could have led to denial of service (bsc#1171496).
- CVE-2020-11864: Fixed an issue which could have led to denial of service (bsc#1171499).
- CVE-2020-11865: Fixed an out of bounds memory access (bsc#1171497).
- CVE-2020-11866: Fixed a use after free (bsc#1171498).
- Record
SUSE-SU-2020:1621-2- Updated
- 2026-11-02
OSVSUSE-SU-2020:1622-1 No score
Security update for libEMF
This update for libEMF fixes the following issues:
- CVE-2020-11863: Fixed an issue which could have led to denial of service (bsc#1171496).
- CVE-2020-11864: Fixed an issue which could have led to denial of service (bsc#1171499).
- CVE-2020-11865: Fixed an out of bounds memory access (bsc#1171497).
- CVE-2020-11866: Fixed a use after free (bsc#1171498).
- Record
SUSE-SU-2020:1622-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libemfDebian:12 |
before 1.0.12-1 | 1.0.12-1 |
libemfDebian:13 |
before 1.0.12-1 | 1.0.12-1 |
libemfDebian:14 |
before 1.0.12-1 | 1.0.12-1 |
libEMFopenEuler:20.03-LTS-SP1 From an advisory covering 5 CVEs |
before 1.0.13-1.oe1 | 1.0.13-1.oe1 |
libEMFopenEuler:20.03-LTS-SP2 From an advisory covering 5 CVEs |
before 1.0.13-1.oe1 | 1.0.13-1.oe1 |
libEMFSUSE:Linux Enterprise Workstation Extension 15 SP1 From an advisory covering 4 CVEs |
before 1.0.7-3.3.1 | 1.0.7-3.3.1 |
libEMFSUSE:Linux Enterprise Workstation Extension 15 SP2 From an advisory covering 4 CVEs |
before 1.0.7-3.3.1 | 1.0.7-3.3.1 |
libEMFSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 4 CVEs |
before 1.0.7-11.3.1 | 1.0.7-11.3.1 |
libEMFSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 4 CVEs |
before 1.0.7-11.3.1 | 1.0.7-11.3.1 |
libEMFSUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 4 CVEs |
before 1.0.7-11.3.1 | 1.0.7-11.3.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libEMFSUSE:Linux Enterprise Workstation Extension 12 SP5 From an advisory covering 4 CVEs |
before 1.0.7-11.3.1 | 1.0.7-11.3.1 |
libemfUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.9+git.10.3231442-1 |
None known |
libemfUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.11-2ubuntu11.0.11-2ubuntu2 |
None known |
libEMFopenSUSE:Leap 15.1 From an advisory covering 4 CVEs |
before 1.0.7-lp151.3.3.1 | 1.0.7-lp151.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11864 is a medium vulnerability (CVSS 5.5) in Libemf Project Libemf, published May 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in libemf 1.0.12-1.
References
sourceforge.net/p/libemf/mailman/libemf-devel
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DFYDSKWFM2R5NKZOO2IN6X7SM3T2PWL
lists.opensuse.org/opensuse-security-announce/2020-06/msg00036.html
nvd.nist.gov/vuln/detail/CVE-2020-11864
Show 22 moreShow less
github.com/advisories/GHSA-pf4w-prfj-vwv2
security-tracker.debian.org/tracker/CVE-2020-11864
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1376
suse.com/support/update/announcement/2020/suse-su-20201621-1
bugzilla.suse.com/1171496
ubuntu.com/security/CVE-2020-11864
cve.org/CVERecord?id=CVE-2020-11864