CVE Intelligence
Analysis AI-assisted

CVE-2020-37126: Free Desktop Clock 3.0 Stack Overflow in Time Zones Input

CVE-2020-37126 is a stack-based buffer overflow in Free Desktop Clock 3.0, triggered through the Time Zones display name input. According to the record, a crafted Unicode input can overwrite Structured Exception Handler registers and potentially allow arbitrary code execution. The record reports a CVSS 3.1 score of 9.8 (critical), no confirmed exploitation in CISA KEV, and no affected or fixed versions.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Free Desktop Clock 3.0 is affected by a stack-based buffer overflow in the Time Zones display name input, as described in the record. The issue relates to a crafted Unicode input that can overwrite Structured Exception Handler registers.

Impact

  • The CVSS 3.1 vector reported by VulnCheck is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical).
  • The CVSS 4.0 score reported by the same provider is 8.4.
  • According to the description, successful exploitation could potentially lead to arbitrary code execution.

Affected products and versions

  • The description names Free Desktop Clock 3.0. The record's affected list is empty, so the full range of affected versions is unknown.
  • No fixed version is listed in the record. This does not mean that no fix exists.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation cannot be confirmed from KEV data.
  • No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Identify all systems running Free Desktop Clock and verify installed versions against vendor information.
  • Where a maintained alternative exists, consider removing or discontinuing the application, since the record lists no fixed version.
  • Restrict execution of the application through application allowlisting, and run it with least privilege.
  • Limit exposure to untrusted input, including externally supplied time zone or locale-related text.

Detection guidance

  • Monitor for unexpected crashes or access violation events in the Free Desktop Clock process.
  • Review endpoint logs for unusual child processes or unexpected activity spawned by the application.

Limitations of the available information

  • The record has no affected version list, no fixed version, and no EPSS data.
  • The vendor is not formally confirmed in the record. The referenced domain drive-software.com suggests the vendor website.
  • The record lists an Exploit-DB entry. Its contents were not used for this analysis.

Frequently asked questions

Is CVE-2020-37126 confirmed as actively exploited?

The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

Which versions of Free Desktop Clock are affected?

The description names version 3.0, but the record's affected list is empty, so the full range of affected versions is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.