CVE-2012-4953

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-11-14 · updated 2026-06-16
Weakness: CWE-119

Description

The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file.

Affected products

Symantec Antivirus: 10.1.0, 10.1.4, 10.1.5, 10.1.6, 10.1.7, 10.1.8 (+1)
Symantec Endpoint Protection: 11.0, 12.0
Symantec Scan Engine: through 5.2

References

http://www.kb.cert.org/vuls/id/985625
http://www.securityfocus.com/bid/56399
http://www.securitytracker.com/id?1027726
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121107_00
http://www.kb.cert.org/vuls/id/985625
http://www.securityfocus.com/bid/56399
http://www.securitytracker.com/id?1027726
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121107_00

Get alerted when CVE-2012-4953 or the next vulnerability affects your stack