CVE-2016-9094

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-16 · updated 2026-06-17
Weakness: CWE-20

Description

Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.

Affected products

Symantec Endpoint Protection: through 14.0; 12.1.6-mp7

References

http://www.securityfocus.com/bid/96298
http://www.securitytracker.com/id/1037961
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00
http://www.securityfocus.com/bid/96298
http://www.securitytracker.com/id/1037961
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00

Get alerted when CVE-2016-9094 or the next vulnerability affects your stack