CVE-2021-25252

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-03 · updated 2026-06-17
Weakness: CWE-400

Description

Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.

Affected products

Trend Micro, Inc. Trend Micro Apex Central: 2019
Trend Micro Apex One: 2019
Trend Micro, Inc. Trend Micro Cloud Edge: 5.0
Trend Micro Control Manager: 7.0
Trendmicro Deep Discovery Analyzer: 5.1
Trend Micro Deep Discovery Email Inspector: 2.5
Trend Micro, Inc. Trend Micro Deep Discovery Inspector: 3.8
Trend Micro Deep Security Agent: 10.0, 11.0, 12.0, 20.0
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA): 9.1
Trend Micro InterScan Web Security Virtual Appliance: 6.5
Trend Micro OfficeScan: all versions
Trendmicro Portal Protect: 2.6
Trendmicro Safe Lock: 1.1
Trend Micro ScanMail for Exchange: 14.0
Trendmicro Scanmail For Ibm Domino: 5.8
Trend Micro ServerProtect for Linux: 5.8
Trendmicro Serverprotect For Network Appliance Filers: 5.8
Trendmicro Serverprotect For Storage: 6.0
Trend Micro Worry-Free Business Security: 10.1

References

Get alerted when CVE-2021-25252 or the next vulnerability affects your stack