CVE-2020-0181

HIGH

Android - Denial of Service via Integer Overflow in exif_data_load_data_thumbnail

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-0181. PoCs published by Trinadh465.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2020-0181, a vulnerability in libexif. The exploit demonstrates how to manipulate EXIF data to trigger the vulnerability, which involves a heap-based buffer overflow in the library.

Description

In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076

Exploits (1)

nomisec WORKING POC

by Trinadh465 · poc

https://github.com/Trinadh465/external_libexif_AOSP10_r33_CVE-2020-0181

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2020-0181, a vulnerability in libexif. The exploit demonstrates how to manipulate EXIF data to trigger the vulnerability, which involves a heap-based buffer overflow in the library.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: libexif (AOSP10_r33)

No auth needed

Prerequisites: Access to a target system using libexif · Ability to provide a maliciously crafted EXIF file

MITRE ATT&CK

T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_misc

https://source.android.com/security/bulletin/pixel/2020-06-01

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVBD5JRUQPN4LQHTAAJHA3MR5M7YTAC7/

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/202011-19

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELDZR6USD5PR34MRK2ZISLCYJ465FNKN/

Scores

CVSS v3 7.5

EPSS 0.0286

EPSS Percentile 84.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-190

Status published

Products (4)

fedoraproject/fedora 32

fedoraproject/fedora 33

google/android 10.0

libexif_project/libexif < 0.6.22_p20201105

Published Jun 11, 2020

Tracked Since Feb 18, 2026