CVE-2020-37183
Published: 11 February 2026
Summary
CVE-2020-37183 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Alloksoft (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37183 is a stack overflow vulnerability (CWE-121) affecting Allok RM RMVB to AVI MPEG DVD Converter version 3.6.1217. The flaw occurs in the License Name input field, where insufficient bounds checking allows a buffer overflow that overwrites Structured Exception Handler (SEH) registers. This enables attackers to execute arbitrary code. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network vector, low attack complexity, and no privileges required.
Attackers can exploit this vulnerability remotely by crafting a malicious payload for the License Name field, triggering the buffer overflow upon processing. No authentication or special privileges are needed, and exploitation can achieve full remote code execution, such as running system commands like calc.exe, with high impact on confidentiality, integrity, and availability.
Advisories and references include the vendor site at https://www.alloksoft.com, a proof-of-concept exploit published on Exploit-DB at https://www.exploit-db.com/exploits/47910, and a detailed advisory from VulnCheck at https://www.vulncheck.com/advisories/allok-rm-rmvb-to-avi-mpeg-dvd-converter-stack-overflow-seh. No patches or specific mitigations are detailed in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31176
Vulnerability details
Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload in the License Name input field…
more
to trigger a buffer overflow and execute system commands like calc.exe.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow with SEH overwrite in client-side converter app directly enables arbitrary code execution via crafted License Name input (T1203: Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces bounds checking and validation on inputs like the License Name field to prevent buffer overflows that overwrite SEH registers.
Implements memory safeguards such as DEP, ASLR, and stack canaries to protect against exploitation of stack overflow vulnerabilities leading to arbitrary code execution.
Requires identification, reporting, and remediation of flaws like this stack overflow, including patching or removal of the vulnerable Allok converter software.