CVE-2020-37184: Allok Video Converter RCE Vulnerability

CVE-2020-37184 Overview

CVE-2020-37184 is a stack overflow vulnerability affecting Allok Video Converter version 4.6.1217. The vulnerability exists in the License Name input field and allows attackers to execute arbitrary code on the target system. By crafting a specially designed payload, attackers can overwrite Structured Exception Handler (SEH) handlers and execute system commands by injecting malicious bytecode into the vulnerable input field.

Critical Impact

This stack overflow vulnerability enables arbitrary code execution through SEH handler overwrite, potentially allowing complete system compromise when a user interacts with a malicious payload.

Affected Products

• Allok Video Converter version 4.6.1217
• Windows systems running the affected application

Discovery Timeline

• 2026-02-11 - CVE-2020-37184 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2020-37184

Vulnerability Analysis

This vulnerability is classified under CWE-121 (Stack-based Buffer Overflow), indicating that the application fails to properly validate the length of user-supplied input before copying it to a fixed-size stack buffer. The License Name input field in Allok Video Converter does not implement adequate bounds checking, allowing attackers to provide an excessively long input string that overflows the allocated buffer space.

When the stack buffer overflow occurs, attackers can overwrite critical stack structures including the SEH (Structured Exception Handler) chain. SEH is a Windows mechanism for handling exceptions, and by corrupting these handlers, an attacker can redirect program execution flow to their injected shellcode when an exception is triggered.

The local attack vector requires user interaction—a victim must open a malicious configuration file or manually enter the crafted payload into the License Name field. However, once triggered, the vulnerability provides full code execution capabilities within the context of the running application.

Root Cause

The root cause of CVE-2020-37184 is the lack of input length validation in the License Name field processing routine. The application uses a fixed-size stack buffer to store the license name input but fails to verify that the user-supplied data fits within the allocated buffer before copying. This classic buffer overflow condition allows data to spill beyond the intended memory boundaries, corrupting adjacent stack frames and SEH records.

Attack Vector

The attack leverages a local vector requiring user interaction. An attacker must craft a malicious payload containing carefully calculated padding to reach the SEH handler location on the stack, followed by shellcode or a pointer to attacker-controlled code. When the crafted input is processed by the License Name field:

1. The oversized input overflows the stack buffer
2. SEH handler pointers on the stack are overwritten with attacker-controlled values
3. An exception is triggered (either naturally or intentionally)
4. Windows follows the corrupted SEH chain to the attacker's code
5. Arbitrary commands execute with the privileges of the application

Technical details and a proof-of-concept are available through Exploit-DB #47908.

Detection Methods for CVE-2020-37184

Indicators of Compromise

• Unexpected crashes or exceptions in Allok Video Converter processes
• Presence of abnormally long strings in license registration files or registry entries
• Suspicious child processes spawned by the video converter application
• Evidence of shellcode execution patterns in memory dumps

Detection Strategies

• Monitor for stack overflow exceptions in Allok Video Converter processes using Windows Event Logs
• Deploy endpoint detection rules that identify SEH overwrite patterns in memory
• Implement application whitelisting to detect unexpected process spawning from multimedia applications
• Use SentinelOne's behavioral AI to detect anomalous code execution patterns from desktop applications

Monitoring Recommendations

• Enable detailed logging for application crashes and exception handling events
• Monitor for creation of suspicious files in temporary directories by the video converter
• Track network connections initiated by the application that may indicate post-exploitation activity
• Review registry modifications related to Allok Video Converter license information

How to Mitigate CVE-2020-37184

Immediate Actions Required

• Discontinue use of Allok Video Converter version 4.6.1217 until a patch is available
• Implement application control policies to restrict execution of known vulnerable software
• Deploy endpoint protection solutions capable of detecting and blocking exploitation attempts
• Educate users about the risks of opening untrusted license files or entering unknown license data

Patch Information

No vendor patch information is currently available. Users should check the AllokSoft Home Page for potential updates. Given the age and nature of this software, consider migrating to alternative video conversion solutions that are actively maintained with security updates.

For additional technical details, refer to the VulnCheck Advisory on Allok Video Converter.

Workarounds

• Remove or uninstall Allok Video Converter from systems until a fix is available
• If the software must be used, run it in an isolated environment or sandboxed virtual machine
• Implement Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the OS level to make exploitation more difficult
• Configure application firewalls to block any outbound connections from the video converter application
• Use SentinelOne's application vulnerability assessment to identify and track affected endpoints