CVE-2019-20053: An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 vi...

Security readout for executives and security teams

CVE-2019-20053 describes a UPX 3.95 crash condition triggered by a crafted Mach-O file. The business risk appears concentrated in tooling or automation that uses UPX to inspect or unpack untrusted files. The provided sources do not show active exploitation, CVSS scoring, or confirmed code execution impact. Exposure is most likely where UPX 3.95, or distribution packages based on it, process untrusted Mach-O files in malware analysis, build, scanning, or unpacking workflows. Treat this as a targeted tooling risk, not a broad enterprise emergency based on available evidence. Prioritize teams that process untrusted binaries, especially security analysis and automated scanning environments. Mitigation focus: Identify whether UPX 3.95 is installed or bundled in file-processing workflows.; Review the linked UPX issue and openSUSE advisories for fixed package guidance.; Avoid processing untrusted Mach-O files with vulnerable UPX until guidance is applied..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.