CVE-2020-18171

TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to...

8.8 HighDisputed

TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.39%Unchanged since Jul 27, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2020-18171
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-269
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-18171
Updated: 2026-11-02

EUVDEUVD-2020-10098 No score

Record: EUVD-2020-10098
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3rh8-vm3g-5r4x 8.8

TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to...

TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges.

Record: GHSA-3rh8-vm3g-5r4x
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-269
Updated: 2026-11-02

Affected products

techsmith snagit

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-18171 is a high vulnerability (CVSS 8.8) in Techsmith Snagit, published July 26, 2021. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile.