Is CVE-2020-37212 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37212 being exploited in the wild.

How severe is CVE-2020-37212?

High severity, with a CVSS score of 7.5, published 11 February 2026.

Is there a fix for CVE-2020-37212?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-37212 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2020-37212?

Check whether you run Nsasoft Spotmsn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37212: Nsasoft SpotMSN buffer overflow in registration name field

CVE-2020-37212 · Severity: high · CVSS 7.5 · Published 2026-02-11

SpotMSN, a tool used for recovering MSN Messenger passwords, contains a flaw that allows the application to be crashed. An attacker can trigger this by entering an excessively long name into the registration field. This results in a denial of service, preventing the software from functioning correctly.

Vendors: Nsasoft.

Quick answers

Is CVE-2020-37212 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37212 being exploited in the wild.
How severe is CVE-2020-37212?: High severity, with a CVSS score of 7.5, published 11 February 2026.
Which products and versions are affected?: Nsasoft Spotmsn 2.4.6.
Is there a fix for CVE-2020-37212?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-37212 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-37212?: Check whether you run Nsasoft Spotmsn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in Nsasoft SpotMSN version 2.4.6 within the registration name input field. The vulnerability is triggered when the application fails to perform adequate bounds checking on the 'Name' field during the registration process. An attacker can exploit this by inputting a specially crafted payload of approximately 1,000 characters, leading to an application crash (Denial of Service). While some CVSS metrics suggest a network vector, the exploit typically requires local interaction where a user pastes the payload into the registration dialog on a Windows system. No official patch has been identified in the provided documentation.

Affected products

Nsasoft (Nsauditor) SpotMSN 2.4.6

Timeline

2020-01-06: disclosed: Initial exploit PoC published by Ismail Tasdelen
2026-02-11: advisory: NVD and VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.