CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability
Description
CVE-2020-15999 is a CRITICAL heap buffer overflow vulnerability in the FreeType font rendering library used by Google Chrome, carrying a CVSS 3.1 score of 9.6. A heap buffer overflow in FreeType's Load_SBit_Png function when processing PNG images embedded in fonts allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability is part of exploit chains with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.92905 (99.769th percentile), this vulnerability demonstrates extreme real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 86.0.4240.111 | |
| freetype | freetype | >= 2.6.0, < 2.10.4 |
| debian | debian linux | 10.0 |
| fedoraproject | fedora | 31 |
| opensuse | backports sle | 15.0 |
| netapp | ontap select deploy administration utility | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html(Broken Link, Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2020/Nov/33(Mailing List, Not Applicable, Third Party Advisory)
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html(Third Party Advisory)
- https://crbug.com/1139963(Exploit, Issue Tracking, Third Party Advisory)
- https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html(Exploit, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3QVIGAAJ4D62YEJAJJWMCCBCOQ6TVL7/(Release Notes)
- https://security.gentoo.org/glsa/202011-12(Third Party Advisory)
- https://security.gentoo.org/glsa/202012-04(Third Party Advisory)
- https://security.gentoo.org/glsa/202401-19(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4824(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20240812-0001/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15999(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2020-15999 is classified under CWE-787 — Out-of-bounds Write. Out-of-bounds Write occurs when software writes data to a memory location outside the intended boundaries of a buffer. This vulnerability class consistently ranks as one of the most dangerous software weaknesses due to its direct path to arbitrary code execution through corruption of adjacent data, return addresses, function pointers, or heap metadata.
In the context of FreeType within Chrome, the heap buffer overflow occurs specifically in the Load_SBit_Png function when processing maliciously crafted PNG images embedded within font files. Since FreeType is used by numerous applications beyond Chrome, the impact of this vulnerability extends to any software using vulnerable FreeType versions, including other browsers, PDF readers, and image processing tools.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-15999 carries a CVSS 3.1 score of 9.6 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Successful exploitation enables arbitrary code execution within and potentially beyond the Chrome renderer process, allowing access to sensitive data including browsing data, stored credentials, and information from other applications.
Integrity (HIGH): The attacker gains the ability to execute arbitrary code, enabling modification of data, installation of malware, and alteration of system state on the compromised device.
Availability (HIGH): Complete disruption of the browser and potentially the underlying operating system is possible, ranging from browser crashes to persistent system compromise.
Scope Changed: The Changed scope indicates that exploitation can impact resources beyond the Chrome renderer sandbox, particularly when chained with sandbox escape vulnerabilities like CVE-2020-17087 (Windows kernel) or CVE-2020-16010 (Chrome Android UI).
With an EPSS score of 0.92905 (99.769th percentile), this is one of the most actively exploited vulnerabilities tracked and has been used in sophisticated exploit chains targeting multiple platforms.
Exploit Maturity
CVE-2020-15999 has confirmed active exploitation as a zero-day and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was discovered being actively exploited in the wild by Google's Project Zero team, who reported it in October 2020. It was used in targeted attacks as a zero-day before patches were available for Chrome or FreeType.
Exploit chains: CVE-2020-15999 was used as the initial code execution stage in multi-vulnerability exploit chains. On Windows, it was chained with CVE-2020-17087 (Windows kernel local privilege escalation) for full system compromise. On Android, it was associated with CVE-2020-16010 for sandbox escape.
Ransomware association: No direct ransomware association has been confirmed. The sophisticated multi-stage exploit chains suggest use by advanced threat actors for targeted operations rather than widespread ransomware campaigns.
Attack surface: FreeType is widely used across many software projects, making the attack surface broader than just Chrome. However, Chrome was the confirmed target in the observed exploitation.
KEV deadline: CISA required remediation by 2021-11-17. The earlier deadline compared to other November 2021 additions reflects the critical nature of this vulnerability.
Remediation
- Update Google Chrome immediately. Ensure all instances of Chrome are updated to version 86.0.4240.111 or later. This applies to Chrome on all platforms (Windows, macOS, Linux, Android).
- Update FreeType library across all applications. Since this vulnerability exists in the FreeType library (versions before 2.10.4), update FreeType wherever it is used in your environment. This includes other browsers, PDF readers, and any application that renders fonts.
- Patch the Windows kernel vulnerability (CVE-2020-17087). Since CVE-2020-15999 was chained with CVE-2020-17087 for full system compromise on Windows, ensure Windows systems are patched against both vulnerabilities.
- Monitor for indicators of compromise. Check for signs of exploitation including unusual Chrome process behavior, unexpected font file downloads, and indicators associated with the specific exploit chains used in the wild.
- Implement defense-in-depth measures. Enable site isolation in Chrome, keep all system software updated, and consider application sandboxing solutions that limit the impact of browser exploitation.
- Review and update software inventory. Identify all software in your environment that uses FreeType and ensure each is updated to a version containing the fix for CVE-2020-15999.
Technical Details
CVE-2020-15999 is a CRITICAL-severity heap buffer overflow in the FreeType library used by Google Chrome for font rendering. The vulnerability can be triggered remotely by visiting a web page containing a malicious font.
Technical mechanism: The vulnerability exists in FreeType's Load_SBit_Png function, which is responsible for loading PNG images embedded within font files (specifically in CBDT/CBLC tables used for color emoji fonts). When processing a specially crafted PNG bitmap in a font file, the function fails to properly validate the bitmap dimensions against the allocated buffer size, resulting in a heap buffer overflow. An attacker can embed a malicious font in a web page that triggers this overflow when Chrome attempts to render it.
Exploit chain details: In observed attacks, CVE-2020-15999 was used for initial code execution in the Chrome renderer process. On Windows, this was chained with CVE-2020-17087, a Windows kernel buffer overflow in the cng.sys driver, to achieve privilege escalation and full system compromise.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a network-accessible attack requiring user interaction (visiting a page) with Changed scope due to sandbox escape potential. All impact metrics are HIGH.
Affected versions: Google Chrome prior to 86.0.4240.111 and FreeType versions prior to 2.10.4.
Frequently Asked Questions
Is CVE-2020-15999 being actively exploited?
Yes, CVE-2020-15999 was actively exploited as a zero-day before patches were available. Google's Project Zero discovered the in-the-wild exploitation in October 2020. The vulnerability was used in sophisticated exploit chains targeting multiple platforms including Windows (chained with CVE-2020-17087) and Android (associated with CVE-2020-16010).
What products are affected by CVE-2020-15999?
Google Chrome prior to version 86.0.4240.111 is the confirmed exploitation target. However, since the vulnerability exists in the FreeType library (pre-2.10.4), any application using vulnerable FreeType versions is potentially affected. This includes other Chromium-based browsers, PDF readers, image viewers, and font rendering tools.
How do I fix CVE-2020-15999?
Update Google Chrome to version 86.0.4240.111 or later on all platforms. Additionally, update the FreeType library to version 2.10.4 or later in all applications that use it. On Windows, also apply the patch for CVE-2020-17087 since both were used together in exploit chains.
How severe is CVE-2020-15999?
CVE-2020-15999 is rated CRITICAL with a CVSS score of 9.6, Changed scope, and an EPSS score of 0.92905 (99.769th percentile). It was exploited as a zero-day in sophisticated multi-stage attacks and affects a widely-used font rendering library. The combination of confirmed exploitation, extreme EPSS score, and broad attack surface makes this one of the most severe vulnerabilities in the KEV catalog.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.