Read the docs
TI-2020-07147 Aliases CVE-2020-8896GHSA-33rh-fh49-758p

Buffer Overflow in Google Earth Pro

Priority LOW 27CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it. Mitigation: Update to Google Earth Pro 7.3.3.

Why it matters now

EPSS 0.00404 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleGoogle Earth Prostable – 7.3.2—No fix listedCNA
  • Google Earth Pro VendorGoogle Affected stable – 7.3.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:earth:*:*:*:*:pro:*:*:*before 7.3.3VulnerableGoogle
  • cpe:2.3:a:google:earth:*:*:*:*:pro:*:*:* Versions before 7.3.3 Vulnerable ·Google

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8896
  2. 2026-10-03 Alias added: GHSA-33rh-fh49-758p

References

Advisory 1

  • TI-2010-02995 Untrusted search path vulnerability in Google Earth 5.1.3535.3218 allows local users, and… CVSS 2.0HIGH 9.3
  • TI-2006-06898 Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to… CVSS 2.0HIGH 7.1
  • TI-2020-07146 DLL Hijacking in Google Earth Pro Windows installer CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences