CVE-2020-15904: bsdiff4 out-of-bounds write via patch file
Summary
CVE-2020-15904: bsdiff4 out-of-bounds write via patch file. Affects bsdiff4 versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bsdiff4 is a Python library that provides binary diff and patch functionality. It is commonly used for creating and applying patches to binary files. The library allows users to efficiently update large files by only transmitting the differences between versions. However, a vulnerability has been discovered in bsdiff4 versions prior to 1.2.0 that can be exploited by an attacker to write to heap memory beyond the allocated bounds. This vulnerability exists in the patching routine of bsdiff4 and can be triggered by a specially crafted patch file.
Vulnerability Detail
The vulnerability in bsdiff4 allows an attacker to perform an out-of-bounds write, which means they can write data to memory locations beyond what is intended. By exploiting this vulnerability, an attacker can potentially overwrite critical data in the heap, leading to a variety of consequences such as crashing the application, executing arbitrary code, or escalating privileges. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 1.3.1 as of 23 Oct 2026
pip install --upgrade "bsdiff4==1.3.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
pip install --upgrade "bsdiff4==1.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of bsdiff4 as soon as possible.
Conclusion
The bsdiff4 library is vulnerable to an out-of-bounds write vulnerability that can be exploited by providing a specially crafted patch file. To mitigate this vulnerability, it is recommended to update to bsdiff4 version 1.2.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bsdiff4 →
FAQ
bsdiff4 is a Python library that provides binary diff and patch functionality. It is commonly used for creating and applying patches to binary files.
An out-of-bounds write vulnerability allows an attacker to write data to memory locations beyond what is intended. This can lead to various consequences, such as crashing the application, executing arbitrary code, or escalating privileges.
The bsdiff4 vulnerability can be exploited by providing a specially crafted patch file that triggers the out-of-bounds write in the patching routine of the library.
The potential consequences of this vulnerability include crashing the application, executing arbitrary code, or escalating privileges.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
