CVE-2020-37162

CriticalPublic PoC

Published: 07 February 2026

Published

07 February 2026

Modified

24 February 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37162 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Wedding-Slideshow-Studio Wedding Slideshow Studio. Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates the registration key input to prevent oversized or malformed payloads from triggering the stack-based buffer overflow.

SI-16 Memory Protection good match

prevent

Implements memory safeguards like stack canaries, ASLR, and DEP to block arbitrary code execution even if the buffer overflow occurs.

SI-2 Flaw Remediation good match

prevent

Requires identification, reporting, and timely remediation of flaws such as this buffer overflow vulnerability in the affected software.

NVD Description

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and…

execute commands through the registration key field.

Deeper analysisAI

CVE-2020-37162 is a stack-based buffer overflow vulnerability affecting Wedding Slideshow Studio version 1.36, specifically in the registration key input field. The flaw, classified as CWE-122, allows attackers to overwrite memory and execute arbitrary code by submitting a crafted malicious payload of 1608 bytes through this field. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.

The vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation enables remote arbitrary command execution, providing high-impact access to confidentiality, integrity, and availability of the affected system.

Resources for further details include a Vulncheck advisory on the buffer overflow, an Exploit-DB entry (exploit 48028) demonstrating the issue, and an archived version of the Wedding Slideshow Studio website. No patch or mitigation details are specified in the available references.