What’s Vulnerable › Vulnerabilities

CVE-2019-20016

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-27 · updated 2026-06-17
• Weakness: CWE-787

Description

libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.

Affected products

• Symonics Libmysofa: before 0.9 — fixed in 0.9

How to fix

Upgrade to a fixed version: Symonics Libmysofa 0.9. Check the vendor advisory for mitigations.

References

• https://github.com/hoene/libmysofa/commit/2e6fac6ab6156dae8e8c6f417741388084b70d6f
• https://github.com/hoene/libmysofa/issues/83
• https://github.com/hoene/libmysofa/issues/84
• https://github.com/hoene/libmysofa/commit/2e6fac6ab6156dae8e8c6f417741388084b70d6f
• https://github.com/hoene/libmysofa/issues/83
• https://github.com/hoene/libmysofa/issues/84

Get alerted when CVE-2019-20016 or the next vulnerability affects your stack