CVE-2020-17528
Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length
CVE-2020-17528 is a critical vulnerability (CVSS 9.1) in Apache Nuttx, published December 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.17%, the 88th percentile. No source names a fixed version.
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
- Record
CVE-2020-17528- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
- Record
CVE-2020-17528- Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2020-9464
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
- Record
EUVD-2020-9464- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36mq-qwm2-6rpp No score
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and...
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
- Record
GHSA-36mq-qwm2-6rpp- Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt memory by supplying arbitrary urgent data pointer offsets within TCP packets including beyond the length of the packet.
- Record
CVE-2020-17528- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.apache.org/thread.html/r7f4215aba288660b41b7e731b6262c8275fa476e91e527a74d2888ea%40%3Cdev.nuttx.apache.org%3E
openwall.com/lists/oss-security/2020/12/09/4
nvd.nist.gov/vuln/detail/CVE-2020-17528
github.com/advisories/GHSA-36mq-qwm2-6rpp