Read the docs
TI-2020-10658 Aliases CVE-2020-13580GHSA-r56q-wqp9-hrw3

Out-of-bounds write in Softmaker Software

Priority HIGH 72CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. A specially crafted document can cause the document parser to explicitly trust a length from a particular record type and use it to write a 16-bit null relative to a buffer allocated on the stack. Due to a lack of bounds-checking on this value, this can allow an attacker to write to memory outside of the buffer and controllably corrupt memory. This can allow an attacker to earn code execution under the context of the application. An attacker can entice the victim to open a document to trigger this vulnerability.

Why it matters now

EPSS 0.70688 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Softmaker SoftwareGmbH SoftMaker Office PlanMaker 2021 (Revision 1014)—No fix listedCNA
  • Softmaker Software Vendor— Affected GmbH SoftMaker Office PlanMaker 2021 (Revision 1014) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:softmaker:planmaker_2021:1014:*:*:*:*:*:*:*1014VulnerableSoftmaker
  • cpe:2.3:a:softmaker:planmaker_2021:1014:*:*:*:*:*:*:* Versions 1014 Vulnerable ·Softmaker

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13580
  2. 2026-10-03 Alias added: GHSA-r56q-wqp9-hrw3

References

Exploit 1

  • TI-2020-10657 Integer overflow in Softmaker Software CVSS 3.1HIGH 7.8
  • TI-2020-16575 Heap-based buffer overflow in Softmaker CVSS 3.1HIGH 7.8
  • TI-2020-16574 Heap-based buffer overflow in Softmaker CVSS 3.1HIGH 7.8
  • TI-2020-16573 Heap-based buffer overflow in Softmaker CVSS 3.1HIGH 7.8
  • TI-2020-10664 Heap-based buffer overflow in Softmaker CVSS 3.1HIGH 7.8
  • TI-2020-17319 Heap-based buffer overflow in Softmaker CVSS 3.1HIGH 7.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences