–no cvss
CVE-2017-20190
Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of mult…
Published 2 y ago · modified 4 mo ago · JSON
CVSS
—
not scored
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 18%
Public exploits
0
none known
Summary
Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a "Zalgo text" attack. NOTE: third parties dispute whether the computational cost of interpreting Unicode data should be considered a vulnerability.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.
Affected products
- microsoft windows
Classification
- Weakness
- CWE-176 Improper Handling of Unicode Encoding
References
- talk.dynalist.io /t/dynalist-is-vulnerable-to-zalgo/1234 · x_transferred
- en.wikipedia.org /wiki/Zalgo_text · x_transferred
- aka.ms /windowsbugbar · x_transferred
Sources
- CVE List: CVE-2017-20190
- NVD: CVE-2017-20190
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.