CVE-2020-37120
Published: 05 February 2026
Description
Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious text file with carefully constructed payload to execute arbitrary code…
more
by overwriting SEH and triggering remote code execution.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted inputs like the DICOM server name field to prevent buffer overflows that enable SEH overwrite and arbitrary code execution.
Implements memory protection mechanisms such as DEP and ASLR to block exploitation of buffer overflows via SEH overwrite even if input validation fails.
Mandates timely identification, reporting, and correction of flaws like this buffer overflow vulnerability in the Rubo DICOM Viewer.
Security SummaryAI
CVE-2020-37120 is a buffer overflow vulnerability in Rubo DICOM Viewer 2.0, affecting the DICOM server name input field. The flaw enables attackers to overwrite the Structured Exception Handler (SEH), as detailed in the CVE description and classified under CWE-121. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.
Unauthenticated remote attackers can exploit this vulnerability without privileges or user interaction by crafting a malicious text file with a carefully constructed payload. Triggering the buffer overflow overwrites SEH, allowing arbitrary code execution on the target system running the affected DICOM viewer.
Advisories and references, including an archived Rubo Medical product page, an Exploit-DB entry (48351) providing a proof-of-concept exploit, and a VulnCheck advisory on the Rubo DICOM Viewer buffer overflow SEH issue, document the vulnerability but do not specify patches or mitigations in the available details.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow with SEH overwrite enables remote arbitrary code execution without authentication or user interaction, directly mapping to exploitation of a public-facing or network-accessible application.