CVE-2020-37179
Published: 11 February 2026
Summary
CVE-2020-37179 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsauditor (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2020-37179 is a denial of service vulnerability in APKF Product Key Finder version 2.5.8.0. The flaw arises from a buffer overflow in the 'Name' input field, mapped to CWE-120 (Buffer Copy without Checking Size of Input). It carries a CVSS v3.1 base score of 7.5, reflecting high availability impact with no confidentiality or integrity effects (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The vulnerability was published on 2026-02-11.
The attack scenario involves any unauthenticated remote attacker generating a 1000-character payload and pasting it into the application's registration name field. This triggers an application crash, denying service to legitimate users without requiring privileges or additional user interaction.
Advisories and proof-of-concept exploits are documented in referenced sources, including an Exploit-DB entry at https://www.exploit-db.com/exploits/47937 and a VulnCheck advisory at https://www.vulncheck.com/advisories/apkf-product-key-finder-name-denial-of-service. No specific patches or mitigation steps are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31207
Vulnerability details
APKF Product Key Finder 2.5.8.0 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the 'Name' input field. Attackers can generate a 1000-character payload and paste it into the registration name field to trigger…
more
an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in local input field directly enables application crash for DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs at externally-facing interfaces, directly preventing buffer overflows from oversized payloads like the 1000-character Name field.
SI-9 enforces restrictions on the amount and characteristics of inputs, such as limiting the length of the registration Name field to avert buffer overflow crashes.
SI-11 mandates controlled error handling that avoids application crashes from invalid inputs, mitigating the DoS impact of buffer overflows.