CVE-2020-10062

An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.

Scoring

Severity

CRITICAL

CVSS base score

9

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability

5.82%

CWE

CWE-193

Published

2020-06-05

Last modified

2026-03-14

Affected products

• zephyrproject-rtos zephyr

Weakness type

• CWE-193

Related vulnerabilities

• CVE-2023-44444 — GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
• CVE-2026-79148 — Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social enginee
• CVE-2024-10442 — Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0
• CVE-2021-21938 — A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A
• CVE-2020-14510 — OFF-BY-ONE ERROR CWE-193
• CVE-2023-30546 — Contiki-NG has off-by-one error in Antelope DBMS
• CVE-2024-51554 — off-by-one-error
• CVE-2026-65927 — Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Markdown version · Browse all CVEs