CVE-2020-37140: AIDA64 Denial of Service Vulnerability

CVE-2020-37140 Overview

CVE-2020-37140 is a denial of service vulnerability affecting Everest (later referred to as AIDA64) version 5.50.2100. This vulnerability allows local attackers to crash the application by manipulating the file open functionality. The attack is straightforward—an attacker can generate a 450-byte buffer of repeated characters and paste it into the file open dialog, triggering an application crash.

Critical Impact

Local attackers can cause application crashes and disrupt system diagnostic operations by exploiting improper input handling in the file open dialog.

Affected Products

• Everest 5.50.2100
• AIDA64 (successor product) - potentially affected versions based on shared codebase

Discovery Timeline

• 2026-02-05 - CVE CVE-2020-37140 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2020-37140

Vulnerability Analysis

This vulnerability is classified under CWE-787 (Out-of-Bounds Write), indicating that the application fails to properly validate input length when processing file path data in the file open dialog. The local attack vector requires user interaction, as the victim must engage with the file open dialog functionality while the malicious input is present. The vulnerability affects only the availability of the application without impacting confidentiality or integrity of system data.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the file open dialog handler. When a user pastes an oversized buffer (approximately 450 bytes of repeated characters) into the file open dialog, the application fails to properly bounds-check this input before processing. This results in an out-of-bounds write operation that corrupts memory and causes the application to crash.

Attack Vector

The attack requires local access to the target system where Everest/AIDA64 is installed. An attacker must craft a buffer containing approximately 450 bytes of repeated characters and paste this payload into the file open dialog box. When the application attempts to process this oversized input, it fails to handle the boundary condition properly, resulting in a denial of service condition.

The exploitation technique involves triggering the file open dialog (typically via File > Open menu option or keyboard shortcut), then pasting the crafted payload into the filename input field. The application crashes immediately upon processing the malformed input, disrupting any ongoing system diagnostic or monitoring operations.

Detection Methods for CVE-2020-37140

Indicators of Compromise

• Unexpected crashes of the Everest or AIDA64 application, particularly during file operations
• Application crash logs indicating memory corruption or access violations in the file dialog handler
• Presence of unusually long clipboard contents containing repeated character patterns

Detection Strategies

• Monitor for repeated application crashes with crash dumps indicating buffer overflow conditions
• Implement application whitelisting and monitor for abnormal process termination events
• Deploy endpoint detection solutions capable of identifying denial of service attack patterns against desktop applications

Monitoring Recommendations

• Configure Windows Event Log monitoring to detect application crash events for everest.exe or aida64.exe
• Implement process stability monitoring to alert on repeated application failures
• Review crash dump analysis for patterns consistent with buffer overflow exploitation

How to Mitigate CVE-2020-37140

Immediate Actions Required

• Restrict access to systems running vulnerable versions of Everest/AIDA64 to trusted users only
• Consider upgrading to newer versions of AIDA64 if available with proper input validation fixes
• Implement application control policies to limit who can interact with the affected software
• Monitor for unusual application behavior or repeated crashes

Patch Information

Users should check with the vendor for updated versions that address this vulnerability. Technical details and proof-of-concept information are available through the Exploit-DB #48259 entry. Additional advisory information can be found at the VulnCheck Denial of Service Advisory.

Workarounds

• Limit local access to systems running the vulnerable application to trusted users only
• Disable or restrict clipboard functionality when using the affected application in sensitive environments
• Consider deploying alternative system diagnostic tools if the vulnerability cannot be mitigated through patching
• Implement endpoint protection solutions that can detect and block denial of service attack patterns

# Restrict application execution to specific user groups (Windows example)
# This limits who can launch the vulnerable application
icacls "C:\Program Files\FinalWire\AIDA64\aida64.exe" /inheritance:r /grant:r Administrators:RX