What is CVE-2020-8871?

CVE-2020-8871 is a medium-severity vulnerability in Parallels Desktop, classified under Out-of-bounds Write. CVSS score: 6.7/10. Published 2020-03-23.

How severe is CVE-2020-8871?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Is CVE-2020-8871 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Parallels Desktop

CVE-2020-8871

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 . An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VGA virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-9403.

Vulnerability class: Buffer Overflow

EPSS: 0.006 (45.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Parallels Desktop — versions 15.1.0-47107
Parallels Parallels_desktop

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

Public proof-of-concept exploits

References

zdi-disclosures@trendmicro.com (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-8871?: CVE-2020-8871 is a medium-severity vulnerability in Parallels Desktop, classified under Out-of-bounds Write. CVSS score: 6.7/10. Published 2020-03-23.
How severe is CVE-2020-8871?: Medium severity. CVSS v3 base score is 6.7 out of 10.
Is CVE-2020-8871 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.