CVE-2020-37140 Everest 5.50.2100 - 'Open File' Denial of Service
Local attackers can crash the Everest application by pasting a large buffer into the file open dialog, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-37140?
CVE-2020-37140 is a medium-severity denial of service vulnerability in FinalWire Everest, published on 5 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Everest, later referred to as AIDA64, 5.50.2100 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating file open functionality. Attackers can generate a 450-byte buffer of repeated characters and paste it into the file open dialog to trigger an application crash.
Weakness: CWE-787
Which versions are affected by CVE-2020-37140?
It affects 1 product.
Products include Aida64 Aida64.
How do I fix CVE-2020-37140?
No fix has been published for CVE-2020-37140 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-37140 being exploited?
There is no known exploitation of CVE-2020-37140 in the wild and no public exploit code.
Other vulnerabilities in FinalWire Everest
- CVE-2019-25629 AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via Logging
- CVE-2019-25631 AIDA64 Business 5.99.4900 SEH Buffer Overflow via EggHunter
- CVE-2019-25633 AIDA64 Extreme 5.99.4900 SEH Buffer Overflow via EggHunter
- CVE-2019-25360 Aida64 6.10.5200 - Buffer Overflow
- CVE-2020-19513 Memory corruption in n/a
Sources
Also known as GHSA-pxw8-jmj5-8539.