CVE-2020-36967

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zortam Mp3 Media Studio 27.60 contains a buffer overflow vulnerability in the library creation file selection process that allows remote code execution. Attackers can craft a malicious text file with shellcode to trigger a structured exception handler (SEH) overwrite and execute arbitrary commands on the target system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Zortam.com	Zortam Mp3 Media Studio	27.60

References

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-369686.5M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an admin CVE-2020-369698.8M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions by manipulating the a CVE-2020-369708.4PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system files by manipulating th CVE-2020-369718.4Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration parameter. Attackers ca CVE-2020-369727.5SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to e CVE-2020-369736.5PDW File Browser 1.3 contains a remote code execution vulnerability that allows authenticated users to upload and rename webshell files to a CVE-2020-369747.8Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary CVE-2020-369757.8EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitr CVE-2020-369767.8Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local user CVE-2020-369777.8Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local atta CVE-2020-369786.4Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Atta CVE-2020-369797.8Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers c