CVE-2020-27485

CVE-2020-27485 is a critical array index error affecting Garmin Forerunner 235 devices running firmware versions prior to 8.20. The vulnerability resides in the ConnectIQ TVM, where the program interpreter fails to validate indices for local variable access, enabling out-of-bounds memory read/write. This can lead to a use-after-free condition, providing a constrained read/write primitive across the device's entire MAX32630 address space. A successful exploit, initiated by a malicious ConnectIQ application uploaded to the app store, would allow the application to escape its sandbox and execute arbitrary code. Despite its CVSS score of 9.9 (CRITICAL) and high FAUCET Risk Score, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion.