CVE-2020-37234
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.
Risk Assessment
The risk includes local denial of service, which can disrupt application functionality and impact user productivity, but does not lead to remote compromise.
Recommendation
It is recommended to update Internet Download Manager to the latest version that fixes this vulnerability, and to limit input length in configuration fields.
Other vulnerabilities in Internet Download Manager
See all- CVE-2025-56231Critical
Tonec Internet Download Manager 6.42.41.1 and earlier fails to validate SSL certificates, allowing attackers to bypass update protections.
- CVE-2026-90493High
A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The kernel driver idmwfp.sys exposes the \\.\IDMWFP device interface to authenticated local users with an access control descriptor equivalent to D:P(A;;GA;;;AU), and its IOCTL 0x12C028 handler does not authenticate the caller or restrict operations to IDM-owned registry namespaces. This allows a low-privileged local authenticated user to read, create, modify, and delete arbitrary registry values under HKLM and HKU.
Original NVD description (English source)
Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS