Every CVE Search/ Get API key

CVE-2020-18651

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0...

6.5 MediumFix available

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.26%Up 1.2 points since Aug 23, 2023
90%50%10%1%

What each source reports

NVD Score used 6.5

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
CVE-2020-18651
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
CVE-2020-18651
Updated
2026-11-02
EUVDEUVD-2020-10575 No score

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
EUVD-2020-10575
Updated
2026-11-03
GitHub AdvisoriesGHSA-7ch9-xw7x-hf3m 6.5

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0...

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
GHSA-7ch9-xw7x-hf3m
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 6.5

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
CVE-2020-18651
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-18651 6.5

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
DEBIAN-CVE-2020-18651
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2023-1690 6.5

exempi security update

Exempi is an implementation of XMP. Version 2.x is based on Adobe XMP SDK and released under a BSD-style license like Adobe's.

Security Fix(es):

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.(CVE-2020-18651)

Buffer Overflow vulnerability in WEBP_Support.cpp in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted webp file.(CVE-2020-18652)

XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory locations and causing a local denial of service in the context of the current user. User interaction is required to exploit this vulnerability in that the victim will need to open a specially crafted MXF file.(CVE-2021-40732)

Record
OESA-2023-1690
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3066 6.5

Red Hat Security Advisory: exempi security update

Record
RHSA-2024:3066
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-18651 6.5

Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame.

Record
UBUNTU-CVE-2020-18651
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:3066 No score

Moderate: exempi security update

Exempi provides a library for easy parsing of XMP metadata.

Security Fix(es):

  • exempi: denial of service via opening of crafted audio file with ID3V2 frame (CVE-2020-18651)
  • exempi: denial of service via opening of crafted webp file (CVE-2020-18652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:3066
Updated
2026-11-02
OSVRLSA-2024:3066 No score

Moderate: exempi security update

Exempi provides a library for easy parsing of XMP metadata.

Security Fix(es):

  • exempi: denial of service via opening of crafted audio file with ID3V2 frame (CVE-2020-18651)

  • exempi: denial of service via opening of crafted webp file (CVE-2020-18652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Record
RLSA-2024:3066
Updated
2026-11-02
OSVSUSE-SU-2023:3734-1 No score

Security update for exempi

This update for exempi fixes the following issues:

  • CVE-2020-18651: Fixed a buffer overflow in ID3 support (bsc#1214486).
Record
SUSE-SU-2023:3734-1
Updated
2026-11-02
OSVSUSE-SU-2023:3833-1 No score

Security update for exempi

This update for exempi fixes the following issues:

  • CVE-2020-18651: Fixed a buffer overflow in ID3 support (bsc#1214486).
Record
SUSE-SU-2023:3833-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exempi
AlmaLinux:8
 before 2.4.5-4.el8
2.4.5-4.el8
exempi-devel
AlmaLinux:8
 before 2.4.5-4.el8
2.4.5-4.el8
exempi
Debian:12
 before 2.5.1-1
2.5.1-1
exempi
Debian:13
 before 2.5.1-1
2.5.1-1
exempi
Debian:14
 before 2.5.1-1
2.5.1-1
exempi
Debian:10
 before 2.5.0-2+deb10u1, plus listed versions
2.5.0-2
2.5.0-2+deb10u1
exempi
openEuler:20.03-LTS-SP3
 before 2.4.5-5.oe1
2.4.5-5.oe1
exempi
Red Hat:enterprise_linux:8::appstream
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
Show 13 moreShow less
Affected packages
PackageAffectedFixed
exempi-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi-devel
Red Hat:enterprise_linux:8::crb
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi
Rocky Linux:8
 before 0:2.4.5-4.el8
0:2.4.5-4.el8
exempi
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.2.1-5.10.1
2.2.1-5.10.1
exempi
SUSE:Linux Enterprise Server 12 SP5
 before 2.2.1-5.10.1
2.2.1-5.10.1
exempi
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.2.1-5.10.1
2.2.1-5.10.1
exempi
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 2.4.5-150000.3.9.1
2.4.5-150000.3.9.1
exempi
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
 before 2.4.5-150000.3.9.1
2.4.5-150000.3.9.1
exempi
openSUSE:Leap 15.4
 before 2.4.5-150000.3.9.1
2.4.5-150000.3.9.1
exempi
openSUSE:Leap 15.5
 before 2.4.5-150000.3.9.1
2.4.5-150000.3.9.1
exempi
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.2.2-22.2.2-2ubuntu0.1
 None known
exempi
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.3-1ubuntu12.4.5-22.4.5-2ubuntu0.1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-18651 is a medium vulnerability (CVSS 6.5) in Exempi Project Exempi, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in exempi 2.4.5-4.el8.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open