vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-15999

CRITICAL
9.6
CVSS Score
Published: November 3, 2020 at 12:00 AM UTC
Updated: June 17, 2026 at 02:57 AM UTC
6 products affected across 6 vendorsDebian LinuxChromeFedora

Using Chrome by Google?

Get instant alerts when new vulnerabilities affect Chrome - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.6
Exploitation
CISA KEV
Exploit prediction
EPSS 64%
SSVC
Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score63.9%

EPSS (Exploit Prediction Scoring System) estimates a 63.9% chance this CVE is exploited in the wild within the next 30 days — higher than 99% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

Required Action
Apply updates per vendor instructions.
Ransomware Use
Unknown
Added to KEV
Nov 3, 2021
Remediation Due
Nov 17, 2021
1810 days overdue
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-15999

Description

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
10.0
Fedora· Fedora Projectrpm
95%
31
FreeType· Freetype
95%
2.6.0 ≤ v < 2.10.4
Affected range stops below 2.10.4, so it looks safe — our inference, not a vendor statement
Chrome· Googlenpm
95%
v < 86.0.4240.111
Affected range stops below 86.0.4240.111, so it looks safe — our inference, not a vendor statement
ONTAP Select Deploy administration utility· NetApp
95%
All versions
Backports Sle· openSUSE
95%
15.0 sp2

References (12)

Vendor Advisoryx_refsource_SUSEBroken LinkMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
Mailing ListNot ApplicableThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2020/Nov/33
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
ExploitIssue TrackingThird Party Advisory
Source: [email protected]
https://crbug.com/1139963
ExploitThird Party Advisory
Source: [email protected]
https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html
Vendor AdvisoryRelease Notes
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/
Vendor Advisoryx_refsource_GENTOOThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202011-12
Vendor AdvisoryThird Party Advisory
Source: [email protected]
https://security.gentoo.org/glsa/202012-04

SSVC — Action Prioritization

SSVCActiveNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

9.6CRITICALCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-787CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card