CVE-2020-37198
Published: 11 February 2026
Summary
CVE-2020-37198 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Co (inferred from references). Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2020-37198 is a denial of service vulnerability in Duplicate Cleaner Pro version 4.1.3, stemming from a stack buffer overflow (CWE-121). The flaw occurs when an oversized buffer is injected into the license key field, allowing attackers to crash the application. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no effects on confidentiality or integrity.
Any attacker can exploit this vulnerability without privileges by generating a 6000-byte payload and pasting it into the license activation field, triggering an application crash. The attack is feasible over the network with low complexity and no required user interaction, enabling straightforward denial of service against affected systems running the vulnerable software.
Advisories and additional details, including an exploit proof-of-concept, are available at https://www.vulncheck.com/advisories/duplicate-cleaner-pro-denial-of-service and https://www.exploit-db.com/exploits/47873. The vendor's website is at https://www.digitalvolcano.co.uk/index.html. No specific patch or mitigation guidance is detailed in the CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31188
Vulnerability details
Duplicate Cleaner Pro 4.1.3 contains a denial of service vulnerability that allows attackers to crash the application by injecting an oversized buffer into the license key field. Attackers can generate a 6000-byte payload and paste it into the license activation…
more
field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in license key field directly enables application crash via exploitation, matching Endpoint DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (including the license key field) to reject oversized buffers before they reach the vulnerable parsing routine.
Mandates memory-protection mechanisms that can prevent a stack buffer overflow from causing an application crash.
Requires prompt remediation of the known stack-buffer-overflow flaw in Duplicate Cleaner Pro 4.1.3.