EUVD-2026-107375
GHSA-vvhg-cxrm-qp98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device inspecting network traffic
-
ExploitSend crafted VBA decompression data
-
ExecutionTrigger improper range check overflow
-
ImpactSnort 3 Detection Engine restarts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the targeted Cisco device (Cisco Secure Firewall Threat Defense, UTD Snort IPS Engine, or open-source Snort 3) to be actively running the Snort 3 Detection Engine and inspecting network traffic that contains VBA (Office macro) data, so that the VBA Decompression Engine processes the attacker-supplied, user-controlled VBA stream. No authentication and no user interaction are required (PR:N/UI:N), and the attacker only needs to send the crafted VBA data across a path the engine inspects. Limiting factors: the device must have Snort 3 inspection enabled on a policy that decompresses VBA content and must be positioned to see attacker traffic; impact is restricted to a service restart / DoS with no confidentiality or integrity effect. |
| Impact | This is a medium-severity, unauthenticated remote denial-of-service issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) shows a network-reachable, low-complexity, no-privilege, no-interaction flaw whose only impact is partial availability (A:L) - there is no confidentiality or integrity impact and no code execution, despite the CWE-121 stack buffer overflow classification (the overflow results in an engine restart, not RCE per Cisco's description). The scope change (S:C) reflects that a Snort 3 Detection Engine restart affects traffic other than the attacker's own, which is why availability impact extends beyond the vulnerable component. No EPSS score was provided in the input, so exploitation probability cannot be quantified. This CVE is NOT listed in CISA KEV and no public exploit (POC) is referenced, so the real-world exploitation signal is currently absent. The combination of easy reachability but only DoS impact makes this a patch-in-normal-cycle item for most defenders, elevated only where the affected Cisco inspection devices are internet-facing and inspect file-bearing traffic. No signals are directly conflicting, but the absence of EPSS/KEV/POC data means exploitation likelihood is inferred, not measured. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends traffic containing crafted/malformed VBA (Office macro) data through a Cisco device whose Snort 3 engine is configured to inspect and decompress such content. Improper range checking during VBA decompression overflows stack data and causes the Snort 3 Detection Engine to restart, dropping or interrupting inspected traffic. No public exploit code is referenced, and the attack requires no authentication or user interaction (AV:N/PR:N/UI:N), though it only yields a DoS (A:L), not code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
RemediationAI
Use the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9 as the authoritative remediation source and upgrade affected Snort 3, Cisco FTD, and Cisco UTD Snort IPS Engine deployments to the Cisco-recommended fixed release; the provided data does not specify an exact fixed version, so no vendor-released patch version is confirmed here. Until a fixed release is applied, reduce exposure by disabling VBA decompression in Snort 3 inspection policies where Office macro inspection is not required, or by narrowing Snort 3 inspection to only necessary network paths and sources, accepting the trade-off of reduced macro-threat detection or potential inspection coverage gaps. Monitor for unexpected Snort 3 Detection Engine restarts and restrict management and inspection exposure to trusted network segments as compensating controls; these do not remediate the underlying stack overflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is an intrusion detection and prevention engine used by Cisco Secure Firewall Threat Defense and Cisco UTD Snort IPS as well as standalone open-source deployments. Its VBA Decompression Engine parses and decompresses Microsoft Office VBA macro streams so inspection rules can analyze macro content. The vulnerability is CWE-121, a stack-based buffer overflow: user-controlled VBA data is decompressed without adequate range checking, allowing crafted input to overflow stack memory and crash or restart the detection process. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L indicates remote, unauthenticated exploitation with no user interaction, scope change, and low availability impact; the supplied CPEs identify Cisco open-source Snort3, Cisco Secure Firewall Threat Defense software, and Cisco UTD Snort IPS Engine software as affected products.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Remotely reachable inspection engine, no auth or interaction (AV:N/AC:L/PR:N/UI:N); engine restart disrupts other traffic, so S:C with A:L and no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.
This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB