CVE-2020-37176

CriticalPublic PoC

Published: 11 February 2026

Published

11 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0008 22.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-37176 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Torrentrockyou (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 22.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-16 Memory Protection good match

prevent

Implements memory protections like DEP, ASLR, and stack canaries to block arbitrary code execution from SEH overwrites in stack buffer overflows.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the identified stack overflow flaw through patching, workarounds, or removal of the vulnerable Torrent 3GP Converter application.

SI-10 Information Input Validation good match

prevent

Mandates validation of inputs to the registration dialog to enforce bounds checking and prevent the buffer overflow triggering SEH overwrite.

NVD Description

Torrent 3GP Converter 1.51 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload targeting the application's registration dialog to trigger code execution and open…

the calculator through carefully constructed buffer overflow techniques.

Deeper analysisAI

CVE-2020-37176 is a stack-based buffer overflow vulnerability (CWE-121) in Torrent 3GP Converter version 1.51. The issue resides in the application's registration dialog, where attackers can overwrite Structured Exception Handler (SEH) registers, enabling arbitrary code execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to high impacts on confidentiality, integrity, and availability.

Remote attackers require no privileges or user interaction to exploit the vulnerability over the network with low complexity. By crafting a malicious payload for the registration dialog, they can trigger the buffer overflow, overwrite SEH records, and achieve arbitrary code execution, as demonstrated in proof-of-concept attacks that launch the calculator application.

Advisories and exploit details are documented at http://www.torrentrockyou.com, https://www.exploit-db.com/exploits/47965, and https://www.vulncheck.com/advisories/torrent-gp-converter-stack-overflow-seh, which include a public exploit for the SEH overwrite technique. No patch information is specified in the available references.