CVE-2020-15904: Pypi BSDIFF4

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.

Affected products

• Pypi BSDIFF4: before 1.2.0 (fixed in 1.2.0)

Published 2020-07-22. Last modified 2026-06-17.