CVE-2020-37234

Internet Download Manager 6.38.12 Scheduler Buffer Overflow

CVSS 6.9 MEDIUMEPSS 0.1%CWE-120

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 6.9EPSS 0.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

16 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Internet Download Manager 6.38.12 contains a buffer overflow vulnerability in the Scheduler component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data exceeding 5000 bytes into the 'Open the following file when done' field to trigger a denial of service condition.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

Internetdownloadmanager · Internet Download Manager

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/49083unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/49083 https://www.vulncheck.com/advisories/internet-download-manager-scheduler-buffer-overflow http://www.internetdownloadmanager.com/http://www.internetdownloadmanager.com/download.html