CVE-2020-37203: Office Product Key Finder DoS Vulnerability

CVE-2020-37203 Overview

CVE-2020-37203 is a denial of service vulnerability in Office Product Key Finder version 1.5.4. The flaw allows a local attacker to crash the application by submitting a specially crafted text string through the Name and Key input field. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires user interaction, as a victim must paste the malicious payload into the registration dialog. The result is an application crash rather than code execution or data disclosure.

Critical Impact
A locally delivered, specially crafted registration input triggers an unhandled condition that terminates the Office Product Key Finder process, producing a denial of service for the affected user.

Affected Products

Office Product Key Finder 1.5.4
Distributed via NSA Auditor / Nsasoft product family
Windows desktop installations of the affected version

Discovery Timeline

2026-02-11 - CVE-2020-37203 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-37203

Vulnerability Analysis

The vulnerability resides in the registration workflow of Office Product Key Finder 1.5.4. The application accepts user-supplied text in the Name and Key field without enforcing proper bounds on the size or structure of the input. When an attacker pastes a crafted payload, the application fails to validate the buffer boundaries, causing an unhandled exception that terminates the process. The issue is categorized as [CWE-120], a classic buffer copy without input size verification.

Because the attack vector is local and depends on the victim pasting attacker-supplied content into the application, the impact is limited to availability of the running process. No confidentiality or integrity impact has been reported. The EPSS probability remains low, reflecting limited exploitation interest given the narrow impact.

Root Cause

The root cause is missing input length validation on the registration field. The application copies the supplied registration string into a fixed-size internal buffer without checking the source length. A payload that exceeds the destination buffer triggers memory corruption sufficient to crash the process but not demonstrated to enable code execution in public research.

Attack Vector

An attacker delivers a text file containing a crafted registration string to the victim. The victim opens the file, copies the contents, and pastes them into the Name and Key registration field. Submitting the input causes Office Product Key Finder to crash. The technique is documented in the Exploit-DB #47867 entry and the VulnCheck Advisory: Office Product Key Finder DoS.

No verified exploitation code is reproduced here. Refer to the published advisory for technical details on the payload structure.

Detection Methods for CVE-2020-37203

Indicators of Compromise

Unexpected termination of the Office Product Key Finder process shortly after user interaction with the registration dialog.
Windows Application Event Log entries showing crash events (Event ID 1000) referencing the Office Product Key Finder executable.
Presence of suspicious text files delivered via email or download that contain oversized or non-printable registration strings.

Detection Strategies

Monitor process termination events for the Office Product Key Finder binary and correlate with recent clipboard or file-open activity.
Inspect Windows Error Reporting (WER) artifacts under %LOCALAPPDATA%\CrashDumps for crash dumps tied to the affected executable.
Apply file-content inspection on inbound text files that contain abnormally long single-line strings targeting product registration workflows.

Monitoring Recommendations

Enable application crash logging and forward Event ID 1000 entries to a central log platform for correlation.
Track user reports of repeated application crashes immediately following clipboard paste actions.
Maintain an inventory of installed Nsasoft utilities so security teams can identify hosts running vulnerable versions.

How to Mitigate CVE-2020-37203

Immediate Actions Required

Identify all endpoints running Office Product Key Finder 1.5.4 and restrict their use until a patched build is confirmed.
Instruct users not to paste untrusted text into the application's registration field.
Block delivery of suspicious text files referencing product registration content through email and web gateways.

Patch Information

No vendor patch is referenced in the published advisory data. Review the NSA Auditor Home Page for vendor updates and verify whether a newer release of Office Product Key Finder addresses the input validation flaw. Until a fixed version is confirmed, treat version 1.5.4 as vulnerable.

Workarounds

Uninstall Office Product Key Finder 1.5.4 from systems where it is not required for business operations.
Restrict execution of the application using software restriction policies or Windows Defender Application Control.
Run the application under a standard user account with limited file system access to minimize secondary impact of a crash.

bash

# Configuration example: block execution via AppLocker publisher rule
# Replace path with the actual install location on your endpoints
New-AppLockerPolicy -RuleType Path `
  -User Everyone `
  -Action Deny `
  -Path "%PROGRAMFILES%\Nsasoft\Office Product Key Finder\*"