CVE-2020-27483

CVE-2020-27483 is an array index error in the ConnectIQ TVM component of Garmin Forerunner 235 devices running firmware prior to version 8.20. An attacker could exploit this by uploading a malicious ConnectIQ application to the ConnectIQ store, leveraging an unchecked offset in the DUP instruction to read memory outside the execution stack. This critical vulnerability (CVSS 9.9) allows for the leakage of sensitive runtime information, such as heap handles, and potentially remote code execution by forging TVM objects. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.