EUVD-2026-44903
GHSA-g4c4-fjm7-hv64
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and high privileges required; scope change to C because UAF in ESET kernel module crashes the OS kernel, crossing privilege boundary from application to kernel.
Primary rating from Vendor (ESET).
CVSS VectorVendor: ESET
Lifecycle Timeline
2DescriptionCVE.org
Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system
AnalysisAI
Use-after-free in ESET's Linux security product kernel components enables a local high-privileged attacker to trigger a kernel panic, causing a complete system crash and denial of service. Both ESET Endpoint Antivirus for Linux and ESET Server Security for Linux are affected across unspecified versions, per ESET's own customer advisory. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; however, server-deployed AV with kernel-level hooks makes the DoS impact operationally significant in production environments.
Technical ContextAI
ESET's Linux security products operate with kernel-level integration - typically via loadable kernel modules or kernel hooks - to perform real-time file and process inspection. CWE-416 (Use After Free) describes a condition where memory is freed but a dangling pointer to that region is subsequently dereferenced, causing unpredictable behavior. In a kernel context, UAF can corrupt kernel data structures and crash the entire system (kernel panic), rather than merely crashing a userspace process. Affected products per CPE are cpe:2.3:a:eset,_spol._s.r.o.:eset_endpoint_antivirus_for_linux and cpe:2.3:a:eset,_spol._s.r.o.:eset_server_security_for_linux, both with wildcard version ranges indicating broad version applicability across the product lines. The 'Information Disclosure' tag present in the source intelligence conflicts with the CVSS 4.0 vector showing VC:N (no confidentiality impact); this discrepancy is unresolved in the available data and should be verified against the full ESET advisory.
RemediationAI
The primary remediation is to apply the patch detailed in the ESET customer advisory at https://support.eset.com/en/ca8972-eset-customer-advisory-use-after-free-vulnerability-in-eset-security-products-for-linux-fixed. No specific fixed version number was independently confirmed from the provided data, so verify the exact target version directly from ESET's advisory before deploying. Patch available per vendor advisory. As a compensating control where patching is temporarily not possible, consider restricting local privileged access to affected hosts - limiting the set of accounts with root or equivalent access reduces the attacker pool that can trigger this condition. Organizations running ESET Server Security on critical infrastructure should prioritize rapid patching given the kernel panic impact, as no workaround can fully mitigate a UAF in a kernel module short of disabling real-time protection (which carries its own security trade-offs). Disabling ESET's kernel module would remove the vulnerability surface but eliminates endpoint protection entirely and is not recommended as a sustainable mitigation.
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discover
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to ex
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete file
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.
The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. Rated critical
Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certifi
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today