# CVE-2020-1918

## Summary

- **CVE ID:** CVE-2020-1918
- **Severity:** UNKNOWN
- **CVSS Score:** 0.01
- **CWE:** CWE-127
- **Published:** Mar 10, 2021
- **Last Modified:** Mar 14, 2026

## Description

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

## Affected Products

- Facebook — HHVM (4.98.1)
- Facebook — HHVM (4.98.0)
- Facebook — HHVM (4.97.1)
- Facebook — HHVM (4.97.0)
- Facebook — HHVM (4.96.1)
- Facebook — HHVM (4.96.0)
- Facebook — HHVM (4.95.1)
- Facebook — HHVM (4.95.0)
- Facebook — HHVM (4.94.1)
- Facebook — HHVM (4.94.0)
- Facebook — HHVM (4.93.2)
- Facebook — HHVM (4.81.0)
- Facebook — HHVM (4.80.2)
- Facebook — HHVM (4.57.0)
- Facebook — HHVM (4.56.3)
- Facebook — HHVM (unspecified)

## References

- [CNA](https://hhvm.com/blog/2021/02/25/security-update.html)
- [CNA](https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.33%
- **EPSS Percentile:** 55.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._