CVE-2020-37134
Published: 05 February 2026
Summary
CVE-2020-37134 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Uvnc (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 8.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2020-37134 is a denial of service vulnerability (CWE-770) affecting UltraVNC Viewer version 1.2.4.0. The issue arises from improper handling of VNC Server input, enabling attackers to crash the application by generating and pasting a malformed 256-byte payload into the VNC Server connection dialog.
Remote attackers can exploit this vulnerability with network access, low complexity, no privileges, and no user interaction required, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation leads to high-impact availability disruption through application termination, rendering the UltraVNC Viewer unusable.
Mitigation details and patches can be found in advisories such as the VulnCheck report at https://www.vulncheck.com/advisories/ultravnc-viewer-vncserver-denial-of-service, the vendor site at https://www.uvnc.com/, and a proof-of-concept exploit at https://www.exploit-db.com/exploits/48291. Security practitioners should verify updates from the vendor and avoid using the affected version.
A public exploit on Exploit-DB highlights the vulnerability's exploitability, though no evidence of widespread real-world abuse is noted in available data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31034
Vulnerability details
UltraVNC Viewer 1.2.4.0 contains a denial of service vulnerability that allows attackers to crash the application by manipulating VNC Server input. Attackers can generate a malformed 256-byte payload and paste it into the VNC Server connection dialog to trigger an…
more
application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to application exploitation causing endpoint DoS via malformed VNC server input leading to crash.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (here the VNC Server connection string) to reject malformed data before it reaches the vulnerable parser.
Mandates denial-of-service protection mechanisms that can limit resource exhaustion or crashes triggered by crafted remote-server responses.
Requires the application to handle erroneous or malformed input gracefully instead of terminating, mitigating the observed crash behavior.