CVE-2016-20037: Identicalsoftware Xwpe

High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days.

xwpe 1.5.30a-2.1 and prior contains a stack-based buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying overly long input strings that exceed buffer boundaries. Attackers can craft malicious command-line arguments with 262 bytes of junk data followed by shellcode to overwrite the instruction pointer and achieve code execution or denial of service.

Affected products

• Identicalsoftware Xwpe: version 1.5.30a-2.1 only

Published 2026-03-28. Last modified 2026-06-17.