{"id":"CVE-2020-8896","aliases":["EUVD-2020-29737","GHSA-33rh-fh49-758p"],"status":"published","title":"Buffer Overflow in Google Earth Pro","description":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00404,"percentile":0.34907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-120"],"published":"2020-05-04T13:25:04Z","modified":"2026-06-17T03:27:08Z","products":[{"vendor":"google","product":"earth"},{"vendor":"google llc","product":"google earth pro"}],"references":[{"url":"https://support.google.com/earth/answer/40901","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8896"},{"url":"https://github.com/advisories/GHSA-33rh-fh49-758p"}],"sources":{"cve":[{"id":"CVE-2020-8896","title":"Buffer Overflow in Google Earth Pro","description":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.","status":"published","published":"2020-05-04T13:25:04Z","modified":"2024-08-04T10:12:11Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29737","description":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.","status":"published","published":"2020-05-04T13:25:04Z","modified":"2024-08-04T10:12:11Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:07:55.71159Z"}],"ghsa":[{"id":"GHSA-33rh-fh49-758p","title":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to...","description":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.","status":"published","published":"2022-05-24T17:17:09Z","modified":"2023-01-29T05:02:25Z","updated_at":"2026-11-02T14:45:04.822413Z"}],"nvd":[{"id":"CVE-2020-8896","description":"A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.","status":"published","published":"2020-05-04T20:15:13.13Z","modified":"2026-06-17T03:27:08.727Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:05:59.718774Z"}]}}