CVE Watch12 ago 2026

CVE-2020-3992

VMware ESXi OpenSLP Use-After-Free Vulnerability

CVSS

9.8

Crítico

EPSS

83.0%

p100

KEV

SÍ

3 nov 2021

Exploit Today

0-100

Publicado: 20 oct 2020 · Última mod.: 12 ago 2026 · CWE-416

EPSS · 30d

83.0%EPSS · 30 días83.0%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

VMware / ESXi

Vulnerabilidad

VMware ESXi OpenSLP Use-After-Free Vulnerability

Añadido a KEV

3 nov 2021

Remediar antes de

3 may 2022

Uso conocido en ransomware

Sí

Descripción resumida

VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2020-3992

Descripción técnica

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-58099—

—

———When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.9h CVE-2026-865678.8 ALT

—

——0A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.20h CVE-2026-1020785.9 MED

—

——0A Use After Free vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When web filtering for TCP traffic is configured, a high volume of DNS requests increases the likelihood of a flowd crash and restart, which leads to a complete service outage until the service has automatically recovered. This is a race condition outside the attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S5; * from 23.4 before 23.4R2-S6; * from 24.2 before 24.2R2-S3; * from 24.4 before 24.4R2-S1; * from 25.2 before 25.2R1-S1, 25.2R2.19h CVE-2026-1019706.5 MED

—

——0A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.19h CVE-2026-972058.1 ALT

—

——0NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.5h CVE-2026-84471—

—

——0The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.1d