EUVD-2025-210907
GHSA-28x7-ppgv-4277
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable via automatic file scanning, high complexity to craft a reliable trigger, no authentication needed, DoS-only impact with no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine.
AnalysisAI
Out-of-bounds memory read in Withsecure Atlant's Capricorn scanning engine allows remote unauthenticated attackers to crash the antivirus engine by submitting a crafted document file for processing, resulting in a denial of service. All Atlant deployments running a Capricorn engine build prior to 2025-01-20_02 are affected. No public exploit code has been identified and no active exploitation is recorded; the low CVSS score of 3.7 reflects high attack complexity and a limited, partial availability impact.
Technical ContextAI
Withsecure Atlant is an enterprise cloud-based antivirus and endpoint detection product (CPE: cpe:2.3:a:withsecure:atlant:*:*:*:*:*:*:*:*) whose Capricorn engine performs file content scanning. The root cause is CWE-125 (Out-of-Bounds Read): during parsing of a document file, the engine reads beyond the allocated buffer boundary. This class of flaw commonly arises in file-format parsers that fail to validate length fields, offsets, or structure sizes against remaining buffer bounds before dereferencing them. An out-of-bounds read in an AV engine is particularly reachable because content is automatically parsed from untrusted input without prior filtering.
RemediationAI
Vendor-released patch: Capricorn engine build 2025-01-20_02 or later. Administrators should confirm that Withsecure Atlant's automatic engine update mechanism has applied at minimum this build date, verifiable through the product management console. The vendor advisory at https://support.withsecure.com/en/security-advisories/cve-2025-26790/ should be consulted for specific update guidance. If an immediate engine update is not feasible, reducing attack surface by restricting which document file types are submitted to the scanning engine (if the product supports content-type filtering policies) may limit exposure, though this trade-off reduces detection breadth and should only be used as a temporary compensating control.
Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler. Rated high severity (CV
Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanni
Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of ser
Certain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning a fuzzed PE32 file. Ra
Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. Rated high severity (CVSS 7.5
Certain WithSecure products allow Denial of Service in the aeelf component. Rated high severity (CVSS 7.5), this vulnera
Certain WithSecure products allow Denial of Service (infinite loop). Rated high severity (CVSS 7.5), this vulnerability
Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. Rated high severity (CVSS 7.5), this vulnera
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. Rated high severity
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. Rated high severity
Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. Rated high severity (C
Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. R
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today