https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-18171.htmlhttps://patchthecve.com/cve/CVE-2020-18171.htmlWed, 17 Jun 2026 02:59:12 +0000HIGH 8.8: TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details.https://patchthecve.com/cve/CVE-2020-18169.htmlhttps://patchthecve.com/cve/CVE-2020-18169.htmlWed, 17 Jun 2026 02:59:12 +0000HIGH 7.8: A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details.https://patchthecve.com/cve/CVE-2020-11541.htmlhttps://patchthecve.com/cve/CVE-2020-11541.htmlWed, 17 Jun 2026 02:50:22 +0000MEDIUM 5.5: In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltrate data under the local Administrator account.https://patchthecve.com/cve/CVE-2019-13382.htmlhttps://patchthecve.com/cve/CVE-2019-13382.htmlWed, 17 Jun 2026 02:16:40 +0000HIGH 7.8: UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary https://patchthecve.com/cve/CVE-2018-14446.htmlhttps://patchthecve.com/cve/CVE-2018-14446.htmlWed, 17 Jun 2026 01:41:00 +0000HIGH 8.8: MP4Integer32Property::Read in atom_avcC.cpp in MP4v2 2.1.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted MP4 file.https://patchthecve.com/cve/CVE-2018-14403.htmlhttps://patchthecve.com/cve/CVE-2018-14403.htmlWed, 17 Jun 2026 01:40:56 +0000CRITICAL 9.8: MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated atoms. The resulting type confusion can cause out-of-bounds memory access.https://patchthecve.com/cve/CVE-2018-14379.htmlhttps://patchthecve.com/cve/CVE-2018-14379.htmlWed, 17 Jun 2026 01:40:54 +0000HIGH 8.8: MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0 incorrectly uses the MP4ItemAtom data type in a certain case where MP4DataAtom is required, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted MP4 file, because access thttps://patchthecve.com/cve/CVE-2018-14326.htmlhttps://patchthecve.com/cve/CVE-2018-14326.htmlWed, 17 Jun 2026 01:40:48 +0000HIGH 8.8: In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.https://patchthecve.com/cve/CVE-2018-14325.htmlhttps://patchthecve.com/cve/CVE-2018-14325.htmlWed, 17 Jun 2026 01:40:48 +0000HIGH 8.8: In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.https://patchthecve.com/cve/CVE-2018-14054.htmlhttps://patchthecve.com/cve/CVE-2018-14054.htmlWed, 17 Jun 2026 01:40:33 +0000CRITICAL 9.8: A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again in the destructor once an exception is triggered.