Executive brief
Code::Blocks is a free integrated development environment (IDE) used by programmers to write C, C++, and Fortran code. A buffer overflow vulnerability in version 16.01 allows an attacker to execute arbitrary code when a user opens a specially crafted text file containing malicious data. An attacker could gain full control of a developer's computer, potentially compromising sensitive source code, credentials, or intellectual property.
Technical details
A stack-based buffer overflow exists in Code::Blocks 16.01 when processing specially crafted text files. The vulnerability occurs in the file handling mechanism where Unicode input is not properly validated, allowing an attacker to overwrite the Structured Exception Handler (SEH) on Windows. An attacker must create a malicious text file containing approximately 1,982 bytes of controlled buffer followed by shellcode, then trick a user into opening it through the File menu (File > Class > Class name > Create). When the application attempts to process the file content, the buffer overflow overwrites the SEH pointer, redirecting execution to attacker-supplied shellcode. User interaction (opening the malicious file) is required. The vulnerability has been documented with proof-of-concept exploit code, though active exploitation in the wild has not been reported.
Affected products
- Code::Blocks Code::Blocks 16.01
Timeline
- 2026-02-05: disclosed: CVE-2020-37121 published to NVD