CVE-2020-27486

CVE-2020-27486 is a critical buffer overflow vulnerability affecting Garmin Forerunner 235 devices running firmware versions prior to 8.20. The flaw resides in the ConnectIQ TVM component, specifically in how it handles string lengths within malicious ConnectIQ applications. An attacker could exploit this by uploading a specially crafted ConnectIQ application to the ConnectIQ store. This would allow the application to escape its restricted execution environment, potentially leading to full compromise of the device. Despite its critical CVSS score of 9.9, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.