CVE-2020-36940

Deeper analysis

Easy CD & DVD Cover Creator 4.13 is affected by CVE-2020-36940, a buffer overflow vulnerability in the serial number input field. The flaw, classified under CWE-120, enables attackers to crash the application by generating a 6000-byte payload and pasting it into the field. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with potential for high impacts across confidentiality, integrity, and availability.

Any remote attacker can exploit this vulnerability without privileges or user interaction, according to the CVSS vector. By crafting and delivering the oversized payload to the serial number field, the attacker achieves a denial-of-service condition, crashing the application. While the description focuses on application termination, the high CVSS impact scores suggest possible escalation to broader compromise, though confirmed effects are limited to crashing.

Advisories referenced in Exploit-DB (exploit 49337) provide a proof-of-concept for the crash, demonstrating the 6000-byte payload technique. The Vulncheck advisory specifically details the denial-of-service impact in Easy CD & DVD Cover Creator. No patch or mitigation details are specified in the available information.