A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3.

published 2020-09-16 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-6467

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.6%; EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

A memory corruption vulnerability is present in bspatch as shipped in Colin Percival’s bsdiff tools version 4.3. Insufficient checks when handling external inputs allows an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries.

Patch / fix

distros 1

bsdiff Debian 14, Debian 13, Debian 12 4.3-22

debian advisories DEBIAN-CVE-2020-14315

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14315 updated 2025-11-21 cvss 5.9

bsdiff: handling external inputs allows attacker to bypass sanity checks

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.60% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

x41-dsec.de https://www.x41-dsec.de/lab/advisories/x41-2020-006-bspatch/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a bsdiff

Classification

Weakness

CWE-787 Out-of-bounds Write

References

x41-dsec.de /lab/advisories/x41-2020-006-bspatch/
exploit, third-party-advisory
openwall.com /lists/oss-security/2020/07/09/2
mailing-list, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1856747
issue-tracking, third-party-advisory

Sources

CVE List CVE-2020-14315
NVD CVE-2020-14315

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary