Loading...
Skip to main content
GeekWala

CVE-2020-16009 — Inappropriate implementation in CefSharp.WinForms...

HIGH
Actively Exploited

Inappropriate implementation in V8

Published December 2, 2020Updated February 16, 2024Source: osv

What Should I Do?

Patch Immediately

This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.

Summary

CVE-2020-16009: Inappropriate implementation in V8 - https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009 Google is aware of reports that exploits for CVE-2020-16009 exist in the wild. Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. There is currently little to no public information on the issue other than it has been flagged as `High` severity.

Advisory Timeline

  • First published December 2, 2020 (2140 days ago).
  • Last revised February 16, 2024 — 1171 days after initial publication.
  • Added to CISA's Known Exploited Vulnerabilities catalog 335 days after publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update CefSharp.WinForms to 86.0.241 or later
dotnet add package CefSharp.WinForms --version 86.0.241
NuGet
Update CefSharp.Common to 86.0.241 or later
dotnet add package CefSharp.Common --version 86.0.241
NuGet
Update CefSharp.Wpf to 86.0.241 or later
dotnet add package CefSharp.Wpf --version 86.0.241
NuGet
Update CefSharp.Wpf.HwndHost to 86.0.241 or later
dotnet add package CefSharp.Wpf.HwndHost --version 86.0.241

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: nuget (4).

PackageEcosystemAffectedFixed In
CefSharp.WinForms
nuget
1.25.3, 33.0.0, 33.0.2, 33.1.0-pre01 (+82 more)86.0.241
CefSharp.Common
nuget
31.0.0-pre1, 33.0.0, 33.0.2, 33.1.0-pre01 (+83 more)86.0.241
CefSharp.Wpf
nuget
1.25.2-perlun0, 1.25.3, 1.25.4, 1.25.5 (+90 more)86.0.241
CefSharp.Wpf.HwndHost
nuget
83.4.20-pre, 84.4.10, 85.3.121, 85.3.13086.0.241

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-787
    Out-of-bounds WriteMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2020-16009?
Inappropriate implementation in V8 This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2020-16009?
CVE-2020-16009 affects CefSharp.WinForms, CefSharp.Common and CefSharp.Wpf (and 1 more). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-16009 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Known Exploited Vulnerability

This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Added to KEV catalog: November 3, 2021

Remediation deadline: May 3, 2022

Also Known As

GHSA-m7mf-48hp-5qmr

Related CVEs

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies