CVE-2020-13579: SoftMaker PlanMaker document parsing integer overflow leads to heap overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.8 with user-interaction-only reachability and a high EPSS score make this a serious client-side risk, though it is not in KEV and no active exploitation is documented.

What it is

SoftMaker Office 2021's PlanMaker application has an integer overflow in its document parsing code. A crafted document causes arithmetic to overflow, producing an undersized heap allocation that is then overrun when file data is copied into it, corrupting memory. Because the flaw is reachable by opening a document, it is a realistic client-side code execution risk.

Impact

An attacker can corrupt heap memory and potentially execute code in the context of the PlanMaker application, giving the same privileges as the user running it.

Attack surface

Reached locally by opening a malicious PlanMaker document; the CVSS vector shows no privileges required but user interaction is required, since the victim must open the file.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high (about 0.71, 99th percentile) and the Talos reference is tagged Exploit, indicating public exploit-related detail exists.

What to do

• Update SoftMaker Office 2021 / PlanMaker to a version that fixes the parsing flaw.
• Block or quarantine untrusted PlanMaker documents at email and web gateways until patched.
• Open documents from unknown senders in a sandboxed or isolated environment.
• Enable exploit mitigations such as ASLR and DEP and keep endpoint protection current.

Detection

• Monitor for PlanMaker processes spawning unexpected child processes or making unusual network connections.
• Look for crashes or abnormal termination of PlanMaker when opening documents.
• Scan email and file shares for PlanMaker documents from untrusted sources and alert on their delivery.
• Use endpoint telemetry to detect heap corruption indicators or exploit-mitigation events tied to PlanMaker.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.