CVE Intelligence
Analysis AI-assisted

CVE-2020-37124: b64dec 1.1.2 Stack-Based Buffer Overflow via SEH Overwrite

CVE-2020-37124 describes a stack-based buffer overflow in b64dec 1.1.2 that can let an attacker overwrite the Structured Exception Handler with crafted input during base64 decoding. The record carries a CVSS 3.1 base score of 9.8 (critical) from VulnCheck, and CISA KEV does not list it. The sources consulted do not document affected or fixed versions beyond the one named in the description.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37124 concerns a buffer overflow in b64dec 1.1.2, a base64 decoding tool. According to the record, crafted input can overwrite the Structured Exception Handler, which is the condition that enables arbitrary code execution. The CWE assigned is CWE-121 (Stack-based Buffer Overflow).

Impact

  • The record states that an attacker could execute arbitrary code on a system running the affected software.
  • The CVSS 3.1 base score is 9.8 (critical), with a vector that the record describes as network-reachable, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • VulnCheck also provides a CVSS 4.0 score of 8.4.

Affected products and versions

  • The record names b64dec 1.1.2 as affected.
  • The affected version list and the fixed version list in the record are both empty, so the full range of affected versions is unknown.

Exploitation status

  • CISA KEV does not list this CVE, so no active exploitation is recorded there.
  • No confirmed exploitation appears in the sources consulted. The EPSS score is not available in the record.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a fix in this data does not mean none exists, so check the vendor or maintainer channels and the VulnCheck advisory.
  • If no patch is confirmed, consider removing or replacing b64dec 1.1.2 and avoid processing base64 input from untrusted sources with it.
  • Apply operating system and compiler memory protections that the environment supports, and keep the software isolated from sensitive resources.

Detection guidance

  • Inventory hosts for b64dec and identify any 1.1.2 installations.
  • Monitor for unexpected crashes or abnormal termination of b64dec processes, which can indicate malformed input handling problems.
  • Review logs of systems that run this tool for unusual input sources.

Limitations of the available information

  • The record lacks affected version ranges, fixed versions, EPSS data and SSVC data.
  • Only the NVD entry, the CVE Record and the cited third-party references were consulted. The NVD entry and the Exploit-DB entry were not analysed for technical detail, and technical specifics are intentionally omitted here.

Frequently asked questions

Is CVE-2020-37124 being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. Monitor official channels for any change.

Which versions are affected and is there a fix?

The record names b64dec 1.1.2, but the affected version list and fixed version list are empty. Check the vendor or maintainer channels for a confirmed fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.