Every CVE Search/ Get API key

CVE-2020-35494

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted...

6.1 MediumFix available

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

1.13%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
CVE-2020-35494
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness
CWE-908
Updated
2026-11-02
CVE List No score

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
CVE-2020-35494
Weakness
CWE-908
Updated
2026-11-02
EUVDEUVD-2020-23163 No score

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
EUVD-2020-23163
Updated
2026-11-02
GitHub AdvisoriesGHSA-4cpw-77g4-8rhj 6.1

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted...

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
GHSA-4cpw-77g4-8rhj
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-908
Updated
2026-11-02
OSVBELL-CVE-2020-35494 6.1

CVE-2020-35494 does not affect BellSoft software

Record
BELL-CVE-2020-35494
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSV 6.1

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
CVE-2020-35494
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-35494 6.1

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
DEBIAN-CVE-2020-35494
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-35494 6.1

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

Record
UBUNTU-CVE-2020-35494
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
binutils
Debian:12
before 2.33.50.20200107-1
2.33.50.20200107-1
binutils
Debian:13
before 2.33.50.20200107-1
2.33.50.20200107-1
binutils
Debian:14
before 2.33.50.20200107-1
2.33.50.20200107-1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35494 is a medium vulnerability (CVSS 6.1) in Gnu Binutils, published January 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in binutils 2.33.50.20200107-1.

References

Show 5 moreShow less
MoveEnter Open