Is CVE-2020-13494 actively exploited?

No active exploitation of CVE-2020-13494 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-13494 be exploited remotely?

No. CVE-2020-13494 requires local access to exploit.

What is the CVSS score of CVE-2020-13494?

CVE-2020-13494 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2020-13494

MEDIUM

CVE-2020-13494

CWE-122Published: December 2, 2020· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in out of bounds memory access which could lead to information disclosure. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, victim needs to access an attacker-provided malformed file.

NVD Source

Technical Analysis

CVE-2020-13494 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.