What’s Vulnerable › Vulnerabilities

CVE-2020-15292: Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-17 · updated 2026-06-17
• Weakness: CWE-20

Description

Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory), TOCTOU (IntPeParseUnwindData) or insufficient validations.

Affected products

• Bitdefender Hypervisor Introspection: before 1.132.2 — fixed in 1.132.2

How to fix

Upgrade to a fixed version: Bitdefender Hypervisor Introspection 1.132.2. Check the vendor advisory for mitigations.

References

• https://www.bitdefender.com/support/security-advisories/lack-validation-data-read-guest-memory-bitdefender-hvi-va-9333/
• https://www.bitdefender.com/support/security-advisories/lack-validation-data-read-guest-memory-bitdefender-hvi-va-9333/

Get alerted when CVE-2020-15292 or the next vulnerability affects your stack