Read the docs
TI-2020-11067 Aliases CVE-2020-14127GHSA-vx8g-5qq9-m5gj

Out-of-bounds write in Redmi K40 ,Redmi Note10 Pro

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.

Why it matters now

EPSS 0.01054 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Redmi K40 ,Redmi Note10 ProRedmi K40 MIUI<2022.07.01 ,Redmi Note10 Pro MIUI<2022.07.01—No fix listedCNA
  • Redmi K40 ,Redmi Note10 Pro Vendor— Affected Redmi K40 MIUI<2022.07.01 ,Redmi Note10 Pro MIUI<2022.07.01 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:mi:miui:*:*:*:*:*:*:*:*before 2022.07.01VulnerableMi
cpe:2.3:h:mi:redmi_k40:-:*:*:*:*:*:*:*not specified by NVDRunning onMi
cpe:2.3:h:mi:redmi_note_10_pro:-:*:*:*:*:*:*:*not specified by NVDRunning onMi
  • cpe:2.3:o:mi:miui:*:*:*:*:*:*:*:* Versions before 2022.07.01 Vulnerable ·Mi
  • cpe:2.3:h:mi:redmi_k40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mi
  • cpe:2.3:h:mi:redmi_note_10_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Mi

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14127
  2. 2026-10-03 Alias added: GHSA-vx8g-5qq9-m5gj

References

Advisory 1

  • TI-2020-11065 Out-of-bounds read in Redmi Note 11 ,Redmi Note 9T CVSS 3.1HIGH 7.5
  • TI-2020-11060 Some Xiaomi models have a vulnerability in a certain application. CVSS 3.1HIGH 8.8
  • TI-2020-11063 Double free in MIUI CVSS 3.1HIGH 7.5
  • TI-2020-11048 Incorrect authorization in Xiaomi Mobile Phone CVSS 3.1MEDIUM 5.5
  • TI-2020-11045 The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15. CVSS 3.1MEDIUM 5.5
  • TI-2020-11062 Insufficient verification of data authenticity in MIUI CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences