CVE-2020-37126
Published: 05 February 2026
Summary
CVE-2020-37126 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Drive Software (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Free Desktop Clock 3.0 is affected by CVE-2020-37126, a stack overflow vulnerability in the Time Zones display name input field. The flaw, classified under CWE-121, enables attackers to overwrite Structured Exception Handler (SEH) registers through a crafted malicious Unicode input. This triggers an access violation, with a CVSS v3.1 base score of 9.8 indicating critical severity due to its potential for high impacts on confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation allows arbitrary code execution by leveraging the SEH overwrite, granting full control over the affected system.
Advisories and references, including an Exploit-DB entry at https://www.exploit-db.com/exploits/48314 and a VulnCheck advisory at https://www.vulncheck.com/advisories/free-desktop-clock-x-venetian-blinds-zipper-unicode-stack-overflow-seh, document the issue and proof-of-concept exploit. The vendor site at http://www.drive-software.com provides additional context, though specific patch details are not outlined in available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31022
Vulnerability details
Free Desktop Clock 3.0 contains a stack overflow vulnerability in the Time Zones display name input that allows attackers to overwrite Structured Exception Handler (SEH) registers. Attackers can exploit the vulnerability by crafting a malicious Unicode input that triggers an…
more
access violation and potentially execute arbitrary code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow with SEH overwrite directly enables client-side arbitrary code execution via crafted input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information input validation directly prevents malicious Unicode inputs from causing the stack overflow in the Time Zones display name field.
Memory protection mechanisms like DEP and stack canaries block arbitrary code execution from SEH register overwrites triggered by the stack overflow.
Flaw remediation ensures the specific stack overflow vulnerability in Free Desktop Clock 3.0 is identified, patched, and deployed to eliminate exploitability.