CVE-2005-0249

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 18.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-02-08 · updated 2026-06-16

Description

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.

Affected products

Symantec Antivirus Scan Engine: before 4.3.3 — fixed in 4.3.3
Symantec Brightmail Antispam: 4.0, 5.5
Symantec Client Security: 1.0.1_build_8.01.434-mr3, 1.0.1_build_8.01.437, 1.0.1_build_8.01.446-mr4, 1.0.1_build_8.01.457-mr5, 1.0.1_build_8.01.460-mr6, 1.0.1_build_8.01.464-mr7 (+6)
Symantec Gateway Security: 1.0, 2.0, 2.0.1
Symantec Mail Security: 4.0, 4.1-build_458, 4.1-build_459, 4.1-build_461, 4.5_build_719
Symantec Norton Antivirus: 2.18_build_83, 8.1.1.319, 8.1.1.323, 8.1.1.329, 8.1.1_build8.1.1.314a, 8.01.434 (+8)
Symantec Norton Internet Security: 2004
Symantec Norton System Works: 2004
Symantec Sav Filter Domino Nt Ports: build3.0.5
Symantec Sav Filter For Domino Nt: 3.1.1
Symantec Web Security: 3.01.59, 3.01.60, 3.01.61, 3.01.62, 3.01.63, 3.01.67 (+1)

How to fix

Upgrade to a fixed version: Symantec Antivirus Scan Engine 4.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2005-0249 or the next vulnerability affects your stack