CVE-2020-36971
Published: 28 January 2026
Summary
CVE-2020-36971 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Informer (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-36971 is a local stack buffer overflow vulnerability (CWE-121) affecting Nidesoft 3GP Video Converter version 2.6.18, specifically in the license registration parameter. The flaw occurs when a crafted malicious payload is pasted into the 'License Code' field, triggering the overflow. It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.
A local attacker can exploit this vulnerability with no required privileges (PR:N), low attack complexity (AC:L), and without user interaction (UI:N). By supplying a specially crafted input to the license registration field, the attacker achieves arbitrary code execution on the system, resulting in high impacts to confidentiality, integrity, and availability.
Advisories from VulnCheck and a proof-of-concept exploit on Exploit-DB (ID 49034) document the issue, with additional details available via the software's informer page. No patches or vendor-specific mitigations are referenced in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30878
Vulnerability details
Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers can craft a malicious payload and paste it into the 'License Code' field to execute arbitrary code on the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local stack buffer overflow in client application directly enables arbitrary code execution via crafted input (T1203: Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of flaws like the stack buffer overflow in the license registration parameter to eliminate the vulnerability.
Implements memory safeguards such as DEP, ASLR, and stack canaries to block arbitrary code execution from stack buffer overflow exploits.
Requires validation of information inputs like the license code field to reject malicious payloads that trigger buffer overflows.