CVE-2020-10180

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-05 · updated 2026-06-17
Weakness: CWE-436

Description

The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.

Affected products

ESET Cyber Security: before 1294 — fixed in 1294
ESET Mobile Security: before 1294 — fixed in 1294
ESET Nod32 Antivirus: before 1294; 4 — fixed in 1294
ESET Smart Security: before 1294 — fixed in 1294
ESET Smart Tv Security: before 1294 — fixed in 1294

How to fix

Upgrade to a fixed version: ESET Cyber Security 1294; ESET Mobile Security 1294; ESET Nod32 Antivirus 1294; ESET Smart Security 1294; ESET Smart Tv Security 1294. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-10180 or the next vulnerability affects your stack