Skip to content
Threat Feed
high advisory

xwpe Stack-Based Buffer Overflow Vulnerability (CVE-2016-20037)

A stack-based buffer overflow vulnerability exists in xwpe version 1.5.30a-2.1 and prior, allowing a local attacker to execute arbitrary code or cause denial of service by supplying a crafted command-line argument with an overly long input string.

The xwpe application, version 1.5.30a-2.1 and prior, contains a stack-based buffer overflow vulnerability (CVE-2016-20037). This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service. The attack involves crafting a malicious command-line argument with an input string exceeding buffer boundaries. Specifically, the attacker can supply 262 bytes of junk data, followed by shellcode, to overwrite the instruction pointer and gain control of the application’s…

Detection coverage 2

Detect Suspicious xwpe Command Line Arguments

high

Detects suspicious xwpe command line arguments with lengths exceeding a threshold, potentially indicating a buffer overflow attempt.

sigma tactics: execution techniques: T1210 sources: process_creation, windows

Detect Shellcode in xwpe Command Line Arguments

critical

Detects potentially malicious shellcode within xwpe command line arguments, indicating a buffer overflow exploit attempt.

sigma tactics: execution techniques: T1210 sources: process_creation, windows

Detection queries are kept inside the platform. Get full rules →