CVE-2020-37024: Nidesoft DVD Ripper Buffer Overflow Flaw

CVE-2020-37024 Overview

CVE-2020-37024 is a local stack-based buffer overflow vulnerability in Nidesoft DVD Ripper 5.2.18. The flaw exists in the License Code registration field, where the application fails to validate the length of user-supplied input. Attackers can paste a crafted payload into the License Code field to overwrite the stack and execute arbitrary shellcode in the context of the current user.

The vulnerability is tracked under CWE-120: Buffer Copy without Checking Size of Input. A public proof-of-concept is available on Exploit-DB #48687.

Critical Impact
Successful exploitation allows arbitrary code execution within the Nidesoft DVD Ripper process, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Nidesoft DVD Ripper version 5.2.18
Windows installations of Nidesoft DVD Ripper using the License Code registration component
Any earlier release sharing the same vulnerable registration routine

Discovery Timeline

2026-01-30 - CVE-2020-37024 published to the National Vulnerability Database (NVD)
2026-04-15 - CVE-2020-37024 record last modified in NVD

Technical Details for CVE-2020-37024

Vulnerability Analysis

Nidesoft DVD Ripper 5.2.18 reads the License Code value from the registration dialog into a fixed-size stack buffer without enforcing a maximum length. When the supplied string exceeds the buffer capacity, adjacent stack memory is overwritten, including the saved return address. An attacker controlling that return address can redirect execution to attacker-supplied shellcode placed within the same input.

Exploitation requires user interaction. The victim must paste or enter the malicious string into the License Code field, which corresponds to the User Interaction (UI:A) component in the CVSS vector. Because the attack runs in the user's session, it inherits the privileges of the logged-in account.

The public exploit on Exploit-DB demonstrates a working stack overflow with shellcode delivery. Additional analysis is available in the VulnCheck Nidesoft Advisory.

Root Cause

The root cause is missing bounds checking on the License Code input field. The application copies attacker-controlled data into a stack buffer using an unsafe string operation, allowing the saved return pointer and structured exception handler records on the stack to be overwritten.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a payload containing padding, a return address overwrite, and shellcode, then delivers it to the victim through social engineering. The victim pastes the string into the License Code dialog, triggering the overflow and executing the embedded payload.

The vulnerability is not remotely exploitable over the network. It does not require prior authentication to the application itself, but it does require the victim to launch the registration workflow and submit the payload. See Exploit-DB #48687 for the proof-of-concept payload structure.

Detection Methods for CVE-2020-37024

Indicators of Compromise

Presence of Nidesoft DVD Ripper 5.2.18 binaries on managed endpoints, identified by file hash or installation path under Program Files
Unexpected child processes spawned by the Nidesoft DVD Ripper executable, particularly command interpreters such as cmd.exe or powershell.exe
Crash events or Windows Error Reporting entries referencing the DVD Ripper process with access violations on the stack

Detection Strategies

Inventory endpoints for installations of Nidesoft DVD Ripper and flag any 5.2.x builds as end-of-life software
Monitor for anomalous process trees originating from the DVD Ripper executable, which indicate shellcode execution following the overflow
Apply behavioral detection rules that identify clipboard-paste activity into legacy application registration dialogs followed by process crashes

Monitoring Recommendations

Collect process creation, image load, and crash telemetry from endpoints that retain Nidesoft software
Correlate Windows Error Reporting (WER) events with subsequent suspicious process launches under the same user session
Track outbound network connections from the DVD Ripper process, which legitimate use of the application does not require

How to Mitigate CVE-2020-37024

Immediate Actions Required

Uninstall Nidesoft DVD Ripper 5.2.18 from all managed endpoints, since the product line is no longer actively maintained
Block execution of the Nidesoft DVD Ripper binary using application control or Windows Defender Application Control (WDAC) policies
Educate users not to paste untrusted strings into license or registration fields of legacy software

Patch Information

No vendor patch has been identified for CVE-2020-37024. The Nidesoft DVD Ripper product page does not list an updated release addressing the buffer overflow. Replacement of the software with a maintained alternative is the recommended remediation.

Workarounds

Remove the application and migrate users to a supported DVD ripping tool that receives security updates
Restrict execution of Nidesoft DVD Ripper via AppLocker, WDAC, or equivalent allow-listing controls
Run the application, if temporarily required, inside an isolated non-privileged account or sandbox with Data Execution Prevention (DEP) enforced system-wide

bash

# Configuration example: enforce system-wide DEP on Windows
bcdedit.exe /set {current} nx AlwaysOn

# Block the vulnerable binary with a Windows Defender Application Control rule
New-CIPolicyRule -DriverFilePath "C:\Program Files\Nidesoft\DVD Ripper\DVDRipper.exe" -Level FilePublisher -Deny