CVE-2020-37161
Published: 07 February 2026
Summary
CVE-2020-37161 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wedding-Slideshow-Studio Wedding Slideshow Studio. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37161 is a buffer overflow vulnerability (CWE-121) affecting Wedding Slideshow Studio version 1.36. The issue arises from overwriting the registration name field with a malicious payload, which allows attackers to execute arbitrary code. Published on 2026-02-07, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, authentication, or user interaction. By crafting a specially designed payload for the registration name field, attackers achieve remote code execution, enabling them to run system commands such as launching the calculator.
Advisories from VulnCheck describe the buffer overflow in the name field leading to remote code execution. An exploit proof-of-concept is publicly available on Exploit-DB (exploit ID 48050). The vendor website is located at http://www.wedding-slideshow-studio.com/. No specific patch or mitigation details are provided in the referenced advisories.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31113
Vulnerability details
Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability…
more
to run system commands like launching the calculator.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote attackers to achieve arbitrary code execution over the network with no privileges or user interaction via a buffer overflow in a network-accessible application, directly mapping to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates input to the registration name field to prevent buffer overflows from malicious payloads enabling RCE.
Implements memory protections like address space layout randomization and data execution prevention to mitigate buffer overflow exploitation.
Mandates flaw remediation through patching or removal of vulnerable Wedding Slideshow Studio 1.36 to eliminate the buffer overflow vulnerability.