CVE-2020-16159

CVE-2020-16159 is a critical heap out-of-bounds read vulnerability in GoPro's gpmf-parser 1.5, specifically within the GPMF_ScaledData() function. This flaw allows an unauthenticated attacker to cause a denial of service (crash) or potentially disclose sensitive information by providing specially crafted malicious input. With a CVSS score of 9.1, it presents a high risk due to its network-based attack vector and low complexity. While there is no known active exploitation, publicly available exploit code, or inclusion in the KEV catalog, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.