CVE-2020-37119
Published: 05 February 2026
Summary
CVE-2020-37119 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Nsasoft Nsauditor. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this buffer overflow by identifying, prioritizing, and applying patches or updates to vulnerable Nsauditor versions.
Information input validation prevents the buffer overflow by ensuring malicious DNS query payloads do not exceed allocated memory bounds.
Memory protection mechanisms like stack canaries, DEP, and safe unlinking block exploitation attempts such as the three-byte SEH overwrite even if invalid input reaches the buffer.
NVD Description
Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious DNS query payload to trigger a three-byte overwrite, bypass ASLR, and…
more
execute shellcode through a carefully constructed exploit.
Deeper analysisAI
CVE-2020-37119 is a buffer overflow vulnerability in the DNS Lookup tool of Nsauditor versions 3.0.28 and 3.2.1.0. The flaw enables attackers to execute arbitrary code by overwriting memory through a crafted malicious DNS query payload, which triggers a three-byte overwrite. It is associated with CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write), earning a CVSS v3.1 base score of 9.8.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By constructing a precise payload, they can bypass ASLR and execute shellcode, achieving high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/48350, the vendor site at https://www.nsauditor.com/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/nsauditor-buffer-overflow-sehaslr-bypass-bytes-overwrite detailing the SEH ASLR bypass and three-byte overwrite technique. No patch or mitigation details are specified in the available information.
Details
- CWE(s)