CVE-2020-37183
Stack Overflow in Allok RMVB to AVI Converter Enables Code Execution
Publication date: 2026-02-11
Last updated on: 2026-02-12
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| allok | rm_rmvb_to_avi_mpeg_dvd_converter | to 3.6.1217 (exc) |
| allok | rm_rmvb_to_avi_mpeg_dvd_converter | 3.6.1217 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2020-37183 is a critical stack-based buffer overflow vulnerability in Allok RM RMVB to AVI MPEG DVD Converter version 3.6.1217. It occurs due to improper handling of input in the License Name field, allowing an attacker to craft a malicious payload that overwrites the Structured Exception Handler (SEH) registers on the stack.
By exploiting this vulnerability, an attacker can execute arbitrary code on the affected system. For example, the attacker can trigger system commands such as launching the calculator application (calc.exe) by injecting specially crafted input that causes a buffer overflow and SEH overwrite.
How can this vulnerability impact me? :
This vulnerability allows attackers to execute arbitrary code on the affected system with potentially severe consequences.
- Attackers can run malicious commands or software, potentially compromising system confidentiality, integrity, and availability.
- It can lead to unauthorized control over the system, data theft, or disruption of services.
- Since the attack requires local access and user interaction, it may be exploited by malicious insiders or through social engineering.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the input handling of the License Name field in Allok RM RMVB to AVI MPEG DVD Converter version 3.6.1217. Specifically, sending a crafted payload designed to overwrite the Structured Exception Handler (SEH) registers can confirm the presence of the vulnerability.'}, {'type': 'paragraph', 'content': 'A practical detection method involves using the provided proof-of-concept exploit, which is a Python script that generates a malicious input file ("poc_seh.txt") containing a buffer overflow payload targeting the SEH overwrite.'}, {'type': 'paragraph', 'content': 'While no specific network commands are provided, detection is primarily local and involves running the vulnerable application and inputting the crafted payload into the License Name field to observe if arbitrary code execution (e.g., launching calc.exe) occurs.'}, {'type': 'list_item', 'content': 'Use the Python PoC script from ExploitDB (Resource 1) to generate the malicious input file.'}, {'type': 'list_item', 'content': 'Run the vulnerable application on a test system (Windows 7 SP1 32-bit as verified) and input the malicious payload in the License Name field.'}, {'type': 'list_item', 'content': 'Observe if the application executes arbitrary commands such as calc.exe, indicating the vulnerability.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the vulnerable version 3.6.1217 of Allok RM RMVB to AVI MPEG DVD Converter or earlier versions.
Since the vulnerability requires local access and user interaction, restricting access to the application and limiting user privileges can reduce the risk of exploitation.
Monitor for any suspicious activity involving the application, especially unexpected execution of system commands like calc.exe.
If available, update or patch the software to a version that addresses this stack overflow vulnerability.