Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-37059: Popcorn Time: Malicious Code Can Run with Administrator Privileges

CVE-2020-37059 · published 9 months ago

Summary

An attacker can trick the Popcorn Time service to run malicious code with high-level access on a Windows system. This can happen if an attacker puts a fake program in a certain folder. It's essential to update Popcorn Time to the latest version to prevent this from happening.

Original advisory text

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files (x86) or system root directories to be executed with SYSTEM-level permissions during service startup.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-428Unquoted Search Path or Element

Timeline

Published30 Jan 2026

Updated27 Oct 2026

First seen7 Mar 2026

Sources

CVE-2020-37059 · NVD

Track software like this

Free during beta