CVE-2019-20021: A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.

Security readout for executives and security teams

UPX 3.95 has a memory-reading flaw when handling a specially crafted Mach-O file. The main business risk is disruption or unsafe processing in systems that automatically inspect, unpack, or handle untrusted macOS binaries. The source bundle does not provide CVSS, confirmed impact beyond over-read, or active exploitation evidence. Exposure is most likely in developer workstations, malware-analysis pipelines, CI jobs, or security tools using UPX 3.95 to process Mach-O files. Internet-facing exposure is not shown in the source bundle. Prioritize where UPX processes untrusted binaries automatically. This is not supported as actively exploited or internet-facing from the provided evidence, but it affects security and developer tooling that may ingest hostile files. Mitigation focus: Inventory systems and pipelines that use UPX, especially version 3.95.; Apply vendor or distribution updates referenced by Fedora and openSUSE advisories.; Avoid processing untrusted Mach-O files with vulnerable UPX builds..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.