CVE-2020-37181: Torrent FLV Converter Buffer Overflow

CVE-2020-37181 Overview

CVE-2020-37181 is a stack overflow vulnerability affecting Torrent FLV Converter version 1.51 Build 117. The vulnerability allows attackers to overwrite the Structured Exception Handler (SEH) through a malicious registration code input. By crafting a payload with specific offsets and utilizing partial SEH overwrite techniques, attackers can potentially execute arbitrary code on vulnerable Windows 32-bit systems.

Critical Impact

Local attackers can exploit this stack overflow vulnerability to overwrite the SEH chain and potentially achieve arbitrary code execution on affected Windows 32-bit systems through specially crafted registration codes.

Affected Products

• Torrent FLV Converter 1.51 Build 117
• Windows 32-bit systems running vulnerable versions

Discovery Timeline

• 2026-02-11 - CVE-2020-37181 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37181

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow). The flaw exists in how Torrent FLV Converter handles registration code input. When a user enters a registration code, the application fails to properly validate the length of the input before copying it to a fixed-size stack buffer. This allows an attacker to supply an excessively long input that overwrites the return address and SEH structures on the stack.

The local attack vector requires user interaction, as the victim must be tricked into entering a malicious registration code. The vulnerability specifically targets the exception handling mechanism on Windows systems, making SEH overwrite techniques particularly effective for exploitation.

Root Cause

The root cause is improper input validation in the registration code processing functionality. The application uses an unsafe string copy operation that does not check the boundary of the destination buffer, allowing an attacker-controlled input to overflow the stack buffer and corrupt adjacent memory structures including the SEH chain.

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious registration code containing:

1. Padding bytes to reach the SEH offset
2. A partial SEH overwrite payload using specific byte sequences
3. Shellcode or a pointer to attacker-controlled code

When the malformed registration code is entered and an exception is triggered, the corrupted SEH handler is invoked, redirecting execution to attacker-controlled code. The partial SEH overwrite technique allows bypassing certain security mechanisms on older Windows systems.

The vulnerability mechanism involves overflowing a stack buffer during registration code processing. When the application attempts to validate or store the registration code, insufficient bounds checking allows the input to exceed the allocated buffer size, corrupting the stack frame and SEH chain. Technical details and proof-of-concept information can be found in the Exploit-DB #47938 entry and the VulnCheck Security Advisory.

Detection Methods for CVE-2020-37181

Indicators of Compromise

• Presence of Torrent FLV Converter version 1.51 Build 117 on Windows 32-bit systems
• Abnormally long strings in registration code input fields or configuration files
• Application crashes with access violation or stack corruption errors
• Unexpected process spawning from the Torrent FLV Converter executable

Detection Strategies

• Monitor for abnormal process behavior or crashes related to Torrent FLV Converter
• Implement application whitelisting to prevent unauthorized executables from running
• Use endpoint detection solutions to identify buffer overflow exploitation patterns
• Deploy SentinelOne Singularity to detect and prevent SEH-based exploitation attempts

Monitoring Recommendations

• Enable Windows Event Log monitoring for application crashes and exceptions
• Configure endpoint protection to alert on known vulnerable application versions
• Monitor for unusual child process creation from media converter applications
• Implement file integrity monitoring on application directories

How to Mitigate CVE-2020-37181

Immediate Actions Required

• Remove or disable Torrent FLV Converter version 1.51 Build 117 from all systems
• Migrate to an alternative, actively maintained FLV conversion tool
• Enable Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on Windows systems
• Implement application control policies to restrict execution of legacy software

Patch Information

No official vendor patch is available for this vulnerability. The software appears to be legacy/abandoned. Organizations should consider removing the affected software entirely and migrating to a supported alternative solution. For additional context, refer to the Torrent RockYou Homepage and the VulnCheck Security Advisory.

Workarounds

• Uninstall Torrent FLV Converter and use alternative media conversion software
• If removal is not immediately possible, restrict the application from network access
• Run the application in a sandboxed environment with limited permissions
• Implement strict user awareness training to prevent social engineering attacks that could deliver malicious registration codes

# Disable execution of vulnerable application via Windows Software Restriction Policy
# Run in elevated PowerShell

# Block execution by path
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{GUID}" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{GUID}" -Name "ItemData" -Value "C:\Program Files*\Torrent FLV Converter\*"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{GUID}" -Name "SaferFlags" -Value 0