Garmin vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-27853 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed.High 7.3 · May 13, 2026
• CVE-2025-27851 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.Critical 9.3 · May 13, 2026
• CVE-2025-27850 The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack.High 7.5 · May 13, 2026
• CVE-2023-23306 The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bCritical 9.8 · May 23, 2023
• CVE-2023-23305 The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources.Critical 9.8 · May 23, 2023
• CVE-2023-23304 The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the `Toybox.SensorHistory` moCritical 9.1 · May 23, 2023
• CVE-2023-23303 The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer oCritical 9.8 · May 23, 2023
• CVE-2023-23302 The `Toybox.GenericChannel.setDeviceConfig` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflCritical 9.8 · May 23, 2023
• CVE-2023-23301 The `news` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end of the expected secCritical 9.8 · May 23, 2023
• CVE-2023-23300 The `Toybox.Cryptography.Cipher.initialize` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can result in buffer overfCritical 9.8 · May 23, 2023
• CVE-2023-23299 The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely.High 7.5 · May 23, 2023
• CVE-2023-23298 The `Toybox.Graphics.BufferedBitmap.initialize` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which can result in integer Critical 9.8 · May 23, 2023
• CVE-2022-46081 In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information.High 7.5 · Jan 3, 2023
• CVE-2020-27486 Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow.Critical 9.9 · Nov 16, 2020
• CVE-2020-27485 Garmin Forerunner 235 before 8.20 is affected by: Array index error.Critical 9.9 · Nov 16, 2020
• CVE-2020-27484 Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow.Critical 9.9 · Nov 16, 2020
• CVE-2020-27483 Garmin Forerunner 235 before 8.20 is affected by: Array index error.Critical 9.9 · Nov 16, 2020
• CVE-2009-0194 The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug-In 2.6.4.0 does notHigh 9.3 · May 11, 2009