CVE-2020-37133
Published: 05 February 2026
Summary
CVE-2020-37133 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Uvnc Ultravnc. Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 7.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
UltraVNC Launcher version 1.2.4.0 is affected by CVE-2020-37133, a denial-of-service vulnerability in the Repeater Host configuration field. The issue stems from a buffer overflow, classified under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), where pasting an overly long string of 300 characters into the Repeater Host property triggers an application crash. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact potential alongside the denial-of-service effect.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By supplying the oversized input to the Repeater Host field, they can cause the UltraVNC Launcher application to crash, resulting in a denial of service. The CVSS vector highlights network accessibility and no prerequisites, making it feasible for unauthenticated adversaries to disrupt affected systems.
Advisories and resources, including a proof-of-concept exploit on Exploit-DB (https://www.exploit-db.com/exploits/48288), the UltraVNC vendor site (https://www.uvnc.com/), and a detailed VulnCheck advisory (https://www.vulncheck.com/advisories/ultravnc-launcher-repeaterhost-denial-of-service), document the vulnerability but do not specify patches or mitigations in the provided details. Security practitioners should verify vendor updates and avoid using the affected version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31031
Vulnerability details
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application. Attackers can paste an overly long string of 300 characters into the Repeater Host property to trigger an…
more
application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client config field directly enables application exploitation resulting in crash/DoS (T1499.004); CVSS network vector and C:H impact noted but no confirmed RCE path described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediates the specific buffer overflow flaw in the Repeater Host field of UltraVNC Launcher by applying patches or updates to prevent application crashes from oversized inputs.
Validates the length and format of inputs to the Repeater Host configuration field to block oversized strings that trigger the stack-based buffer overflow and DoS.
Implements memory protections such as stack canaries or DEP to mitigate stack-based buffer overflow exploits that could lead to crashes or confidentiality impacts in UltraVNC Launcher.