CVE-2020-23909
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
CVE-2020-23909 is a high vulnerability (CVSS 7.1) in Advancemame, published July 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.
- Severity
- 7.1 HighCVSS 3.1, NVD
- Exploit chance
- 0.30%EPSS, 23rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
advancecompAzure Linux:2 | through 2.5-1 | None known |
advancecompAzure Linux:3 | through 2.6-1 | None known |
advancecompUbuntu:Pro:16.04:LTS | All versions, plus listed versions 1.19-11.20-11.20-1ubuntu0.11.20-1ubuntu0.21.20-1ubuntu0.2+esm11.20-1ubuntu0.2+esm2 | None known |
cloopUbuntu:16.04:LTS | All versions, plus listed versions 2.6.39.2-1ubuntu33.14.1.1ubuntu13.14.1.2ubuntu1 | None known |
advancecompUbuntu:18.04:LTS | All versions, plus listed versions 2.0-12.1-12.1-1ubuntu0.18.04.12.1-1ubuntu0.18.04.22.1-1ubuntu0.18.04.3 | None known |
cloopUbuntu:18.04:LTS | All versions, plus listed versions 3.14.1.2ubuntu1 | None known |
advancecompUbuntu:20.04:LTS | All versions, plus listed versions 2.1-2.12.1-2.1build12.1-2.1ubuntu0.20.04.1 | None known |
cloopUbuntu:20.04:LTS | All versions, plus listed versions 3.14.1.2ubuntu13.14.1.2ubuntu3 | None known |
advancecompUbuntu:22.04:LTS | All versions, plus listed versions 2.1-2.1ubuntu12.1-2.1ubuntu22.1-2.1ubuntu2.1 | None known |
cloopUbuntu:22.04:LTS | All versions, plus listed versions 3.14.1.3 | None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
advancecompUbuntu:24.04:LTS | All versions, plus listed versions 2.5-12.5-1build1 | None known |
cloopUbuntu:24.04:LTS | All versions, plus listed versions 3.14.1.3+nmu1 | None known |
advancecompUbuntu:25.10 | All versions, plus listed versions 2.5-1build1 | None known |
cloopUbuntu:25.10 | All versions, plus listed versions 3.14.1.3+nmu1 | None known |
advancecompUbuntu:26.10 | All versions, plus listed versions 2.5-1build2 | None known |
cloopUbuntu:26.10 | All versions, plus listed versions 3.14.1.3+nmu1build1 | None known |
advancecompUbuntu:26.04:LTS | All versions, plus listed versions 2.5-1build12.5-1build2 | None known |
cloopUbuntu:26.04:LTS | All versions, plus listed versions 3.14.1.3+nmu13.14.1.3+nmu1build1 | None known |
What each source reports
NVD Score used
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
CVE-2020-23909- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE ListNo score
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
CVE-2020-23909- Updated
- 2026-11-02
EUVDEUVD-2020-16646No score
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
EUVD-2020-16646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-29cr-f47w-93jr
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
GHSA-29cr-f47w-93jr- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVAZL-43516
CVE-2020-23909 affecting package advancecomp 2.5-1
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
AZL-43516- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVAZL-44874
CVE-2020-23909 affecting package advancecomp 2.6-1
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
AZL-44874- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2020-23909
Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.
- Record
UBUNTU-CVE-2020-23909- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.