CVE-2020-13580

An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.

• CWE-787
• CWE-787

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1191Exploit, Technical Description, Third Party Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1191Exploit, Technical Description, Third Party Advisory

Published

Feb 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13575A denial-of-service vulnerability exists in the WS-Addressin…7.5
• CVE-2020-13576A code execution vulnerability exists in the WS-Addressing p…9.8
• CVE-2020-13577A denial-of-service vulnerability exists in the WS-Security …7.5
• CVE-2020-13578A denial-of-service vulnerability exists in the WS-Security …7.5
• CVE-2020-13579An exploitable integer overflow vulnerability exists in the …7.8
• CVE-2020-1358An information disclosure vulnerability exists when the Wind…5.5
• CVE-2020-13581In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (…7.8
• CVE-2020-13582A denial-of-service vulnerability exists in the HTTP Server …7.5
• CVE-2020-13583A denial-of-service vulnerability exists in the HTTP Server …7.5
• CVE-2020-13584An exploitable use-after-free vulnerability exists in WebKit…8.8
• CVE-2020-13585An out-of-bounds write vulnerability exists in the PSD Heade…8.8
• CVE-2020-13586A memory corruption vulnerability exists in the Excel Docume…7.8