CVE-2020-27874

Name of the Vulnerable Software and Affected Versions: Tencent WeChat version 7.0.18

Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the WXAM Decoder due to the lack of proper validation of user-supplied data, resulting in a memory access past the end of an allocated object. An attacker can leverage this to execute code in the context of the current process.

Recommendations: For Tencent WeChat version 7.0.18, as a temporary workaround, consider disabling the WXAM Decoder until a patch is available. Restrict access to potentially malicious pages or files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.