What’s Vulnerable › Vulnerabilities

CVE-2020-27484

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-16 · updated 2026-06-17
• Weakness: CWE-190

Description

Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.

Affected products

• Garmin Forerunner 235 Firmware: from 7.90 before 8.20 — fixed in 8.20

How to fix

Upgrade to a fixed version: Garmin Forerunner 235 Firmware 8.20. Check the vendor advisory for mitigations.

References

• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0004.md

Get alerted when CVE-2020-27484 or the next vulnerability affects your stack