CVE-2020-9498

Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed with the privileges of therunning guacd process.

• CWE-787

• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525Third Party Advisory
• https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/r26fb170edebff842c74aacdb1333c1338f0e19e5ec7854d72e4680fc%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rff824b38ebd2fddc726b816f0e509696b83b9f78979d0cd021ca623b%40%3Cannounce.guacamole.apache.org%3EMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVV5K2X4EXSAVUUL7IJ3MUJ3ADWMVSBM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNS7UHBOFV6JHWH5XOEZTE3BREGRSSQ3/
• https://research.checkpoint.com/2020/apache-guacamole-rce/Third Party Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44525Third Party Advisory
• https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/r26fb170edebff842c74aacdb1333c1338f0e19e5ec7854d72e4680fc%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rff824b38ebd2fddc726b816f0e509696b83b9f78979d0cd021ca623b%40%3Cannounce.guacamole.apache.org%3EMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/11/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVV5K2X4EXSAVUUL7IJ3MUJ3ADWMVSBM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNS7UHBOFV6JHWH5XOEZTE3BREGRSSQ3/
• https://research.checkpoint.com/2020/apache-guacamole-rce/Third Party Advisory

Published

Jul 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and …8.8
• CVE-2020-9493A deserialization flaw was found in Apache Chainsaw versions…9.8
• CVE-2020-9494Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8…7.5
• CVE-2020-9495Apache Archiva login service before 2.2.5 is vulnerable to L…5.3
• CVE-2020-9496XML-RPC request are vulnerable to unsafe deserialization and…6.1
• CVE-2020-9497Apache Guacamole 1.1.0 and older do not properly validate da…4.4
• CVE-2020-9499Some Dahua products have buffer overflow vulnerabilities. Af…7.2
• CVE-2020-9500Some products of Dahua have Denial of Service vulnerabilitie…4.9
• CVE-2020-9501Attackers can obtain Cloud Key information from the Dahua We…5.5
• CVE-2020-9502Some Dahua products with Build time before December 2019 hav…9.8
• CVE-2020-9514An issue was discovered in the IMPress for IDX Broker plugin…6.5
• CVE-2020-9517There is an improper restriction of rendered UI layers or fr…5.4