CVE Intelligence
Analysis AI-assisted

CVE-2020-37162: Wedding Slideshow Studio 1.36 Registration Key Buffer Overflow

CVE-2020-37162 describes a buffer overflow in the registration key input of Wedding Slideshow Studio 1.36 and earlier, which the record says can lead to arbitrary code execution. The CVSS 3.1 base score is 9.8 (critical), reported by VulnCheck. The record lists no fix, and CISA KEV does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37162 affects the registration key input of Wedding Slideshow Studio. According to the record, versions 1.36 and earlier are affected, and the flaw can overwrite memory so that arbitrary code may run. The record describes the issue as a stack-based buffer overflow, but its CWE field assigns CWE-122, which is heap-based. This discrepancy is not resolved by the available sources.

Impact

  • The record states that successful exploitation may allow arbitrary code execution.
  • The CVSS 3.1 vector indicates network reachability, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • VulnCheck also reports a CVSS 4.0 base score of 8.4, without a vector in the record.

Affected products and versions

  • Product listed as Wedding-slideshow-studio Wedding Slideshow Studio, versions 1.36 and earlier.
  • No fixed version is listed in the record.
  • The vendor product page is referenced only as an archived copy from 2020: Archived vendor page.

Exploitation status

  • CISA KEV does not list this CVE, so it is not confirmed as actively exploited in the wild by that catalog.
  • No confirmed active exploitation appears in the sources consulted.
  • A public entry tagged as an exploit exists on Exploit-DB. Its presence means exploit material is public, so exposure should be treated seriously.
  • The EPSS probability is 0.00738 with a percentile of 0.53327.

Remediation and mitigation

  • No vendor fix is documented in the record. Check the vendor for updates or a successor product before relying on the software.
  • If the software cannot be updated, remove it from systems that process untrusted input or restrict its use to isolated environments.
  • Limit who can reach the application and its input fields, and apply least privilege to the account running it.
  • Review the VulnCheck advisory for the vendor-independent analysis.

Detection guidance

  • Monitor for unexpected crashes or restarts of the application, which can indicate malformed input to the registration field.
  • Review endpoint logs for child processes started by the application that are not part of normal operation.
  • Alert on unusually long or unexpected content in registration files or configuration entries where the application stores keys.

Limitations of the available information

  • The record does not confirm whether the overflow is stack-based or heap-based, because the description and CWE field differ.
  • No fixed version, vendor patch or current vendor support status is documented.
  • The sources consulted do not describe the vendor's current product status, and the archived page is from 2020.
  • The EPSS date in the record is later than the publication date, so its timing should be verified before use.

Frequently asked questions

Is CVE-2020-37162 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. A public exploit entry exists on Exploit-DB, so the risk should still be treated seriously.

Which versions are affected and is there a fix?

The record lists Wedding Slideshow Studio 1.36 and earlier as affected. No fixed version is listed, so the availability of a fix is unknown and should be checked with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.