CVE-2020-37203
Published: 11 February 2026
Summary
CVE-2020-37203 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Nsauditor (inferred from references). Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2020-37203 is a denial of service vulnerability in Office Product Key Finder version 1.5.4. The flaw, tied to CWE-120 (Buffer Copy without Checking Size of Input), enables attackers to crash the application by manipulating the registration code input, specifically by pasting a specially crafted text file into the 'Name and Key' field. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting high availability impact with no confidentiality or integrity effects.
Any unauthenticated attacker can exploit this vulnerability remotely, as it requires low attack complexity and no user privileges or interaction. Exploitation involves creating and pasting the crafted input, reliably triggering an application crash and denying service to the targeted user running the affected software.
References include a proof-of-concept exploit at https://www.exploit-db.com/exploits/47867, an advisory from VulnCheck at https://www.vulncheck.com/advisories/office-product-key-finder-denial-of-service, and details from NSAuditor at http://www.nsauditor.com/. No patches or specific mitigations are mentioned in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31185
Vulnerability details
Office Product Key Finder 1.5.4 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the registration code input. Attackers can create a specially crafted text file and paste it into the 'Name and Key'…
more
field to trigger an application crash.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow input triggers application crash, enabling T1499.004 (Application or System Exploitation) for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (e.g., registration code field) to reject malformed data before it reaches the vulnerable buffer-copy routine.
Applies memory-protection mechanisms that can prevent a buffer overflow from successfully corrupting memory and crashing the process.
Requires the application to handle invalid or excessive input gracefully instead of terminating abnormally.