What is CVE-2020-8939?

CVE-2020-8939 is a medium-severity vulnerability in Google Asylo, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2020-12-15.

How severe is CVE-2020-8939?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Out-of-bounds Read in Google Asylo

CVE-2020-8939

An out of bounds read on the enc_untrusted_inet_ntop function allows an attack to extend the result size that is used by memcpy() to read memory from within the enclave heap. We recommend upgrading past commit 6ff3b77ffe110a33a2f93848a6333f33616f02c4

Vulnerability class: Buffer Overflow

Published 2020-12-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N.

EPSS exploit prediction

EPSS: 0.001 (2.5th percentile), scored 2026-10-03.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000

Affected products

Google Asylo
Google Llc Asylo — versions unspecified

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

github.com/google/asylo/commit/6ff3b77ffe110a33a2f93848a6333f33616f02c4 (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2020-8939?: CVE-2020-8939 is a medium-severity vulnerability in Google Asylo, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2020-12-15.
How severe is CVE-2020-8939?: Medium severity. CVSS v3 base score is 5.3 out of 10.