CVE-2020-37162

HighPublic PoC

Published: 07 February 2026

Published

07 February 2026

Modified

24 February 2026

KEV Added

—

Patch

—

CVSS Score v4 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0066 46.6th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2020-37162 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Wedding-Slideshow-Studio Wedding Slideshow Studio. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2020-37162 is a stack-based buffer overflow vulnerability affecting Wedding Slideshow Studio version 1.36, specifically in the registration key input field. The flaw, classified as CWE-122, allows attackers to overwrite memory and execute arbitrary code by submitting a crafted malicious payload of 1608 bytes through this field. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.

The vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation enables remote arbitrary command execution, providing high-impact access to confidentiality, integrity, and availability of the affected system.

Resources for further details include a Vulncheck advisory on the buffer overflow, an Exploit-DB entry (exploit 48028) demonstrating the issue, and an archived version of the Wedding Slideshow Studio website. No patch or mitigation details are specified in the available references.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-31117

Vulnerability details

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and…

execute commands through the registration key field.

CWE(s): CWE-122

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Buffer overflow enables unauthenticated remote arbitrary code execution (T1190: Exploit Public-Facing Application) and client-side code execution via crafted input (T1203: Exploitation for Client Execution).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0