Document vulnerability CVE-2020-9497, fixed in 1.2.0.
diff --git a/_security/CVE-2020-9497.md b/_security/CVE-2020-9497.md
new file mode 100644
index 0000000..633ba70
--- /dev/null
+++ b/_security/CVE-2020-9497.md
@@ -0,0 +1,14 @@
+---
+title: Improper input validation of RDP static virtual channels
+cve: CVE-2020-9497
+fixed: 1.2.0
+---
+
+Apache Guacamole 1.1.0 and older do not properly validate data received from
+RDP servers via static virtual channels. If a user connects to a malicious or
+compromised RDP server, specially-crafted PDUs could result in disclosure of
+information within the memory of the guacd process handling the connection.
+
+Acknowledgements: We would like to thank the GitHub Security Lab and Eyal Itkin
+(Check Point Research) for reporting this issue.
+
