CVE-2020-37000: Free MP3 CD Ripper 2.8 Stack Buffer Overflow
CVE-2020-37000 is a stack-based buffer overflow in Free MP3 CD Ripper 2.8 that, according to the record, can be triggered by a crafted WAV file to execute arbitrary code. The CNA VulnCheck scores it CVSS 3.1 9.8 (Critical), and the record references a public exploit entry. The record does not list KEV status, EPSS data or fixed versions, so remediation status is unconfirmed.
Overview
CVE-2020-37000 affects Free MP3 CD Ripper version 2.8. The record describes a stack-based buffer overflow (CWE-121) that can be reached through a malicious WAV file with an oversized payload. The CNA is VulnCheck, and the NVD record was published on 2026-01-29 with a status of Deferred.
Impact
The CNA description states that a remote attacker could execute arbitrary code on a vulnerable Windows system. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to a network-reachable issue with no privileges or user interaction required, and high confidentiality, integrity and availability impact. CVSS 4.0 from the same CNA gives 8.4.
- Confidentiality, integrity and availability impacts are rated High in the CVSS 3.1 vector.
- Code execution is the stated consequence in the description.
Affected products and versions
- Free MP3 CD Ripper 2.8 is the only version identified in the record.
- The record has an empty affected list, so the full range of affected versions is unknown.
- No fixed version is listed in the record. This does not mean no fix exists; the absence of data is unknown.
Exploitation status
The record is not listed in the CISA KEV catalog, so no active exploitation is confirmed by the sources consulted. The record references an exploit-db entry, which indicates a publicly available exploit reference, but this does not confirm exploitation in the wild. EPSS data is not available in the record.
Remediation and mitigation
- Check the vendor site referenced in the record for an updated version or an official statement. No fixed version is confirmed in the sources.
- If no update is available, consider removing or no longer using the affected software on systems exposed to untrusted files.
- Treat WAV and other media files from unknown sources as untrusted, and restrict where they can be processed.
- Apply standard Windows hardening and endpoint protection controls to limit the impact of unexpected code execution.
Detection guidance
- Monitor for unexpected instances of the ripper application processing files from external or unknown sources.
- Review endpoint logs for crashes or abnormal child processes spawned by the application.
- Inventory systems that have Free MP3 CD Ripper installed, including version 2.8.
Limitations of the available information
The record gives no confirmed fixed version, no full list of affected versions, no KEV or EPSS data, and no SSVC data. The title field was empty and has been written from the record content. The source status is Deferred, so the information may change as sources are updated.
Frequently asked questions
What is CVE-2020-37000?
It is a stack-based buffer overflow in Free MP3 CD Ripper 2.8 that, according to the record, can be triggered by a malicious WAV file to execute arbitrary code.
How severe is this vulnerability?
The CNA VulnCheck assigns CVSS 3.1 a score of 9.8 (Critical) and CVSS 4.0 a score of 8.4. The NVD record lists severity as critical.
Is this vulnerability in the CISA KEV catalog?
No. The record shows the KEV listed field as false, so no active exploitation is confirmed by the sources consulted.
Is a fixed version available?
The record does not list any fixed version. This is unknown, and the vendor site referenced in the record should be checked.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.