CVE-2020-37184: Allok Video Converter RCE Vulnerability

CVE-2020-37184 Overview

CVE-2020-37184 is a stack-based buffer overflow [CWE-121] in Allok Video Converter 4.6.1217. The flaw resides in the License Name input field, which fails to validate the length of user-supplied data. Attackers can craft a payload that overwrites Structured Exception Handler (SEH) records on the stack, redirecting execution to attacker-controlled bytecode. Successful exploitation results in arbitrary code execution in the context of the user running the application.

Critical Impact
An attacker who can place a malicious payload into the License Name field can overwrite SEH handlers and execute arbitrary commands on the host running Allok Video Converter.

Affected Products

Allok Video Converter 4.6.1217
Allok Soft desktop media conversion utilities containing the vulnerable licensing module
Windows installations where the affected version is deployed

Discovery Timeline

2026-02-11 - CVE-2020-37184 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2020-37184

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow triggered through the License Name field in Allok Video Converter 4.6.1217. When a user submits an oversized string, the application copies the input into a fixed-size stack buffer without bounds checking. The overflow extends past the buffer boundary and overwrites adjacent stack data, including the SEH record used by Windows to dispatch exceptions.

By overwriting the SEH nSEH and SEH pointers with attacker-chosen values, an adversary can hijack the exception dispatch routine. Triggering an exception transfers control to attacker-supplied shellcode embedded in the input. The exploitation pattern is documented in the Exploit-DB #47908 public proof of concept and the VulnCheck Security Advisory.

Root Cause

The root cause is missing input length validation on the License Name field. The application relies on unsafe string handling routines that do not enforce destination buffer size. This results in adjacent stack memory, including SEH records, being overwritten by attacker-controlled bytes.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted license file or social-engineers a user into pasting a malicious string into the License Name field. Once submitted, the overflow triggers an exception that executes the attacker payload under the privileges of the logged-on user.

No verified, sanitized exploit code is reproduced here. Technical reproduction details are available in the public Exploit-DB entry referenced above.

Detection Methods for CVE-2020-37184

Indicators of Compromise

Unexpected child processes spawned by AllokVideoConverter.exe or related Allok Soft binaries
Application crash events in the Windows Event Log referencing access violations in the Allok Video Converter process
Presence of suspicious license files or shortcut files containing long unprintable byte sequences in user profile directories
Outbound network connections initiated by the Allok Video Converter process to unknown hosts

Detection Strategies

Monitor for process injection patterns and shellcode execution originating from media conversion utilities
Alert on stack pivots, ROP-style call chains, or non-image memory execution in Allok Video Converter
Hunt for SEH overwrite patterns by inspecting crash dumps that show exception handler addresses pointing to user input regions
Correlate application crashes with subsequent command-shell or scripting interpreter execution under the same user session

Monitoring Recommendations

Enable Windows Error Reporting and forward AppCrash events for Allok Video Converter to a central log platform
Track command-line execution lineage from media conversion software to detect post-exploitation activity
Audit file integrity on application directories to identify tampering with the vulnerable binary

How to Mitigate CVE-2020-37184

Immediate Actions Required

Remove Allok Video Converter 4.6.1217 from systems where it is not business critical
Restrict the ability of standard users to launch the application until a vendor fix is confirmed
Treat any license file or License Name input originating from untrusted sources as hostile
Apply application allowlisting to prevent execution of unsigned or unexpected binaries spawned from the converter process

Patch Information

No vendor patch has been published in the references supplied for this CVE. Consult the Allok Soft Main Page for vendor updates and the VulnCheck Security Advisory for the most current remediation guidance.

Workarounds

Uninstall Allok Video Converter 4.6.1217 and migrate to an actively maintained media conversion tool
Enforce Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) system-wide using Windows Exploit Protection settings
Run the application within a restricted, non-administrative user context to limit post-exploitation impact
Block execution of the vulnerable binary via Windows Defender Application Control or AppLocker policies until remediation is complete

bash

# Configuration example: PowerShell command to block Allok Video Converter via AppLocker default deny
New-AppLockerPolicy -RuleType Path -User Everyone -RulePermission Deny \
  -Path "%ProgramFiles%\Allok Video Converter\AllokVideoConverter.exe" \
  | Set-AppLockerPolicy -Merge