CVE-2020-37024

HighPublic PoC

Published: 30 January 2026

Published

30 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 5.5th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37024 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Softonic (inferred from references). Its CVSS base score is 8.4 (High).

Operationally, ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates the License Code input to block malicious payloads that trigger the stack-based buffer overflow.

SI-16 Memory Protection good match

prevent

Implements memory safeguards like ASLR and DEP to prevent arbitrary code execution from the stack buffer overflow.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the identified buffer overflow flaw through patching or software removal.

NVD Description

Nidesoft DVD Ripper 5.2.18 contains a local buffer overflow vulnerability in the License Code registration parameter that allows attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the License Code field to trigger a…

stack-based buffer overflow and execute shellcode.

Deeper analysisAI

CVE-2020-37024 is a stack-based buffer overflow vulnerability (CWE-120) affecting Nidesoft DVD Ripper version 5.2.18, specifically in the License Code registration parameter. The flaw enables attackers to execute arbitrary code by crafting a malicious payload and pasting it into the License Code field, which triggers the overflow and allows shellcode execution. It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

A local attacker can exploit this vulnerability with low attack complexity and no required privileges. The CVSS assessment indicates no user interaction is needed beyond local access, resulting in high impacts to confidentiality, integrity, and availability. Successful exploitation provides full arbitrary code execution on the target system.

Advisories and related resources include the Nidesoft DVD Ripper page on Softonic, an exploit published on Exploit-DB (ID 48687), and a VulnCheck advisory on the local buffer overflow. No patches or specific mitigation steps are detailed in the provided references.