Read the docs
TI-2020-11063 Aliases CVE-2020-14123GHSA-j77r-52jv-wg32

Double free in MIUI

Priority LOW 35CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.

Why it matters now

EPSS 0.0093 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—MIUIMIUI version 12.5.2—No fix listedCNA
  • MIUI Vendor— Affected MIUI version 12.5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:mi:miui:12.5.2:*:*:*:*:*:*:*12.5.2VulnerableMi
  • cpe:2.3:o:mi:miui:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·Mi

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14123
  2. 2026-10-03 Alias added: GHSA-j77r-52jv-wg32

References

Advisory 1

  • TI-2020-11065 Out-of-bounds read in Redmi Note 11 ,Redmi Note 9T CVSS 3.1HIGH 7.5
  • TI-2020-11060 Some Xiaomi models have a vulnerability in a certain application. CVSS 3.1HIGH 8.8
  • TI-2020-11067 Out-of-bounds write in Redmi K40 ,Redmi Note10 Pro CVSS 3.1HIGH 7.5
  • TI-2020-11048 Incorrect authorization in Xiaomi Mobile Phone CVSS 3.1MEDIUM 5.5
  • TI-2020-11045 The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. CVSS 3.1MEDIUM 5.5
  • TI-2020-11062 Insufficient verification of data authenticity in MIUI CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences