CVE-2020-37161
Published: 07 February 2026
Description
Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability…
more
to run system commands like launching the calculator.
Mitigating Controls (NIST 800-53 r5)AI
Directly validates input to the registration name field to prevent buffer overflows from malicious payloads enabling RCE.
Implements memory protections like address space layout randomization and data execution prevention to mitigate buffer overflow exploitation.
Mandates flaw remediation through patching or removal of vulnerable Wedding Slideshow Studio 1.36 to eliminate the buffer overflow vulnerability.
Security SummaryAI
CVE-2020-37161 is a buffer overflow vulnerability (CWE-121) affecting Wedding Slideshow Studio version 1.36. The issue arises from overwriting the registration name field with a malicious payload, which allows attackers to execute arbitrary code. Published on 2026-02-07, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, authentication, or user interaction. By crafting a specially designed payload for the registration name field, attackers achieve remote code execution, enabling them to run system commands such as launching the calculator.
Advisories from VulnCheck describe the buffer overflow in the name field leading to remote code execution. An exploit proof-of-concept is publicly available on Exploit-DB (exploit ID 48050). The vendor website is located at http://www.wedding-slideshow-studio.com/. No specific patch or mitigation details are provided in the referenced advisories.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote attackers to achieve arbitrary code execution over the network with no privileges or user interaction via a buffer overflow in a network-accessible application, directly mapping to exploitation of a public-facing application.