CVE-2008-0309

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-02-28 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in Symantec Decomposer, as used in certain Symantec antivirus products including Symantec Scan Engine 5.1.2 and other versions before 5.1.6.31, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed RAR file to the Internet Content Adaptation Protocol (ICAP) port (1344/tcp).

Affected products

Symantec Scan Engine: through 5.1.4.24
Symantec Antivirus Filtering Domino Mpe: through 3.0.12
Symantec Antivirus Network Attached Storage: through 4.3.16.39
Symantec Antivirus Scan Engine: through 4.3.16.39
Symantec Antivirus Scan Engine Caching: through 4.3.16.39
Symantec Antivirus Scan Engine Clearswift: through 4.3.16.39
Symantec Antivirus Scan Engine For Microsoft Sharepoint: through 4.3.16.39
Symantec Antivirus Scan Engine For Ms Isa: through 4.3.16.39
Symantec Antivirus Scan Engine Messaging: through 4.3.16.39
Symantec Mail Security For Microsoft Exchange: through 4.6.5.12; through 5.0.4.363

References

Get alerted when CVE-2008-0309 or the next vulnerability affects your stack