Is CVE-2020-37234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37234 being exploited in the wild.

How severe is CVE-2020-37234?

Medium severity, with a CVSS score of 6.2, published 16 May 2026.

Which products and versions are affected?

Tonec Internet Download Manager <= 6.38.12.

Is there a fix for CVE-2020-37234?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-37234 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2020-37234?

Check whether you run Tonec Internet Download Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37234: Internet Download Manager buffer overflow in Scheduler

Q: Is there a fix for CVE-2020-37234?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2020-37234 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2020-37234?

Check whether you run Tonec Internet Download Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37234 · Severity: medium · CVSS 6.2 · Published 2026-05-16

Internet Download Manager is a popular Windows utility used to accelerate and schedule file downloads. A vulnerability in its scheduling component allows a local user to crash the application by entering an excessively long file path. This results in a denial-of-service condition, preventing the software from functioning correctly until it is restarted or the configuration is cleared.

Technologies: Tonec Internet Download Manager. Vendors: Tonec.

Quick answers

Is CVE-2020-37234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37234 being exploited in the wild.
How severe is CVE-2020-37234?: Medium severity, with a CVSS score of 6.2, published 16 May 2026.
Which products and versions are affected?: Tonec Internet Download Manager <= 6.38.12.
Is there a fix for CVE-2020-37234?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-37234 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2020-37234?: Check whether you run Tonec Internet Download Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the Scheduler component of Internet Download Manager version 6.38.12 and earlier. The vulnerability is triggered when a local attacker inputs more than 5,000 bytes into the 'Open the following file when done' configuration field. This lack of input validation leads to a memory corruption that crashes the application (denial of service). While the primary impact is application instability, proof-of-concept code indicates the overflow can overwrite structured exception handlers (SEH) on certain Windows versions, though no remote code execution has been confirmed. Users should update to the latest version of IDM to mitigate this issue.

Affected products

Tonec Internet Download Manager <= 6.38.12

Timeline

2020-11-18: disclosed: Initial discovery and PoC by Vincent Wolterman
2020-11-19: other: Exploit-DB entry published
2026-05-16: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.