CVE-2020-37221

Atomic Alarm Clock 6.3 Stack Overflow via SEH Unicode

CVSS 8.6 HIGHEPSS 0.2%CWE-121

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.6EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

13 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones Clock configuration. Attackers can craft a buffer with structured exception handling overwrite and encoded shellcode to bypass SafeSEH protections and execute arbitrary commands with application privileges.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Drive-software · Atomic Alarm Clock

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/48346unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/48346 https://www.vulncheck.com/advisories/atomic-alarm-clock-stack-overflow-via-seh-unicode