High severity · published Feb 11, 2026
CVE-2020-37188
SpotOutlook 1.2.6 - 'Name' Denial of Service
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
SpotOutlook 1.2.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can overwrite the buffer by pasting 1000 'A' characters into the 'Name' field, causing the application to become unresponsive.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Nsauditor SpotOutlook · Nsasoft
1.2.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37188
www.nsauditor.com
http://www.nsauditor.com/
www.exploit-db.com
https://www.exploit-db.com/exploits/47906
www.vulncheck.com
https://www.vulncheck.com/advisories/spotoutlook-name-denial-of-service