CVE-2020-37184
Published: 11 February 2026
Summary
CVE-2020-37184 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Alloksoft (inferred from references). Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 33.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37184 is a stack overflow vulnerability in Allok Video Converter version 4.6.1217, specifically within the License Name input field. The flaw enables attackers to execute arbitrary code by crafting a specially designed payload that overwrites SEH handlers and injects malicious bytecode into the input field. It is classified under CWE-121 (Stack-based Buffer Overflow) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
The vulnerability is exploitable remotely over the network by any unauthenticated attacker with low attack complexity and no requirement for user interaction or privileges. Successful exploitation allows full control over the affected system, including execution of arbitrary system commands, leading to high impacts on confidentiality, integrity, and availability.
Advisories from VulnCheck detail the stack overflow and SEH overwrite mechanics, while Exploit-DB hosts a proof-of-concept exploit (ID 47908). The vendor site at alloksoft.com is referenced for potential updates, though specific patch details are not outlined in available descriptions. Security practitioners should review these resources for mitigation steps, such as upgrading the software or avoiding untrusted inputs.
A public exploit on Exploit-DB indicates active proof-of-concept availability, heightening the risk of real-world exploitation against unpatched installations of this legacy video converter.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31177
Vulnerability details
Allok Video Converter 4.6.1217 contains a stack overflow vulnerability in the License Name input field that allows attackers to execute arbitrary code. Attackers can craft a specially designed payload to overwrite SEH handlers and execute system commands by injecting malicious…
more
bytecode into the input field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in client application directly enables arbitrary code execution via SEH overwrite and shellcode injection, mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and remediation of software flaws like the stack overflow in Allok Video Converter to eliminate the vulnerability.
Implements memory protections such as DEP, ASLR, and stack canaries to block arbitrary code execution from stack overflows and SEH overwrites.
Prohibits or controls user-installed software, preventing the deployment and execution of vulnerable applications like Allok Video Converter.