CVE-2020-8895 HIGH

CVE-2020-8895: DLL Hijacking in Google Earth Pro Windows installer

Vendor Google

Product Earth Pro

Weakness CWE-427

Published April 21, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system.

Key dates

02Disclosure timeline

April 21, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-8895 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/427.html

Related vulnerabilities

04Related CVE

CVE-2026-2360 Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14 CVE-2023-39374 ForeScout NAC SecureConnector – CWE-427: Uncontrolled Search Path Element CVE-2025-59889 CVE-2025-13670 High Level Synthesis Compiler Security Advisory CVE-2025-66476 Vim for Windows Uncontrolled Search Path Element Remote Code Execution Vulnerability