EUVD-2026-107372
GHSA-jvf5-h9mp-fw5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network traffic to inspecting device
-
DeliveryTraffic reaches vulnerable Snort 3 parser
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt engine memory
-
ImpactCrash or execute code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target device be actively running the Snort 3 inspection engine in a path that processes attacker-reachable traffic - i.e., deployed as part of Cisco Secure Firewall Threat Defense (FTD), the UTD Snort IPS engine, Cisco Cyber Vision, or open-source Snort 3 inspecting network flows. No authentication or user interaction is required (PR:N/UI:N), but CVSS AC:H indicates exploitation is limited by specific conditions the attacker must satisfy - the traffic must reach and trigger the particular vulnerable parsing/inspection code path rather than being a trivially repeatable packet. The precise feature, protocol, or configuration that triggers the out-of-bounds write is not disclosed in the advisory grouping, so defenders should treat any deployment where Snort 3 inspects untrusted traffic as potentially exposed until the vendor-fixed release is applied. |
| Impact | This is a genuinely serious flaw but with meaningful real-world friction. CVSS 3.1 (9.0, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates a network-reachable, unauthenticated out-of-bounds write (CWE-787) in the Snort 3 inspection engine, with a scope change implying compromise of the engine affects the wider host device - appropriate for an inline security-inspection component that processes attacker-influenced traffic by design. The key tempering signal is AC:H: successful exploitation depends on specific, non-trivial conditions rather than a trivially repeatable packet, which lowers the practical ease of attack. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the vulnerability was internally discovered by Cisco's own Snort 3 team, not found in the wild. Net assessment: a credible high-priority patch target because the affected engine sits in widely deployed Cisco security products and the unauthenticated network vector is real, but the absence of exploitation signals plus AC:H argues this is a 'patch promptly, not drop-everything' issue rather than confirmed imminent mass exploitation. Note the data gap: the advisory groups multiple issues under one CVE and does not disclose the precise triggering conditions, so the AC:H justification cannot be independently verified from the input. |
| Exploit ScenarioDerived | An attacker sends specially crafted network traffic that transits a device running the vulnerable Snort 3 engine (e.g., a Cisco Secure Firewall Threat Defense appliance or UTD Snort IPS engine), where the inspection logic mishandles the input and triggers an out-of-bounds write. Because exploitation requires specific conditions (CVSS AC:H), the attacker must shape traffic to hit the vulnerable code path, after which memory corruption could lead to denial of service or potential code execution on the inspecting device. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memory in any deployment where Snort 3 parses attacker-reachable network traffic, potentially leading to arbitrary code execution or a denial-of-service condition in the inspection process. The affected code ships not only as the standalone open-source Snort 3 project but also embedded in Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS engine, and Cisco Cyber Vision, so exposure spans both Cisco appliances and third-party deployments of the open-source engine. Cisco addressed the issues through hardening releases produced during an internal security review, but the advisory groups the findings without publishing per-defect trigger details, and no public exploit code has been identified at time of analysis; CVSS AC:H reflects that an attacker must land traffic on the specific vulnerable parsing path rather than send a trivially repeatable packet.
RemediationAI
Apply the vendor-released Snort 3 hardening release identified in Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe); because the advisory aggregates multiple internally discovered out-of-bounds write defects, exact per-platform fixed version strings are not enumerated in the available data and must be taken directly from that advisory for each of FTD, UTD Snort IPS engine, Cyber Vision, and open-source Snort 3. Where the fixed build cannot be applied immediately, reduce exposure by removing untrusted traffic from the Snort 3 inspection path: on FTD/UTD, temporarily switch inspection to the Snort 2 engine or narrow the inspected traffic with prefilter/preprocessor policy and access-control rules so that untrusted flows do not reach Snort 3 parsers - the trade-off is loss of Snort 3 rule coverage and reduced IPS fidelity for the affected traffic, so scope any such change to the minimum necessary segment. On Cyber Vision and standalone Snort 3 deployments, restrict sensor-facing network segments with ACLs or span-port filtering so only expected protocols reach the sensor - this lowers the attack surface but also reduces visibility into the protocols you exclude, and does not fully eliminate the flaw for permitted traffic. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so prioritization should be driven by whether the sensor inspects internet-facing or otherwise attacker-influenced traffic; those deployments should be patched on an accelerated schedule.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (out-of-bounds write), a memory-safety class in which a length or index calculation performed during packet or protocol parsing is not properly bounded, causing writes past the end of an allocated buffer. In an intrusion-prevention context this is particularly consequential: Snort 3 must decode arbitrary, attacker-controlled protocol data at line rate, so the vulnerable code path is by definition exposed to untrusted input from the network. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H confirms network reachability, no authentication or user interaction prerequisite, and a scope change (S:C), meaning a compromise of the inspection engine can affect resources beyond that component - in appliance form factors such as Secure Firewall Threat Defense and Cyber Vision, that means escaping the parsing context into the broader sensor. The AC:H rating is the important qualifier: exploitation depends on satisfying specific conditions to reach and trigger the particular parsing routine, and because the advisory aggregates multiple internally discovered defects under one CVE, the exact protocol, feature, or configuration that triggers the write is not disclosed. The CPE manifest covers Cisco Cyber Vision, Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and the Cisco UTD Snort IPS engine software, indicating the same underlying engine code is distributed across all four product lines.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Snort inspects attacker-supplied traffic remotely (AV:N) with no auth (PR:N); specific trigger conditions justify AC:H; an engine compromise affecting the host device supports S:C with full C/I/A impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Executive ViewAI
Cisco Snort 3-including its embedded use in Cisco Secure Firewall Threat Defense, the Cisco UTD Snort IPS engine, and Cisco Cyber Vision-has critical memory-safety flaws that could allow attacker-reachable traffic to disrupt or potentially compromise the inspection process. Because these products are inline security controls, successful exploitation could degrade network visibility and protection, affect availability of security services, and require urgent coordinated remediation across distributed estates. No public exploit identified at time of analysis, but the absence of exact fixed versions in the provided context means leadership should treat exposure as a priority pending Cisco confirmation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting attacker-reachable traffic to only required protocols and inspection paths, segmenting and placing redundant inspection nodes to absorb failover, enabling enhanced logging and alerting on Snort inspection-process crashes or restarts, applying Cisco hardening guidance for Snort 3, FTD, UTD, and Cyber Vision, and maintaining rollback-capable configurations; if Cisco confirms the referenced hardening releases, validate and apply vendor hardening releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Multiple internally-discovered coding-standard defects in Cisco Secure Firewall ASA Software, Threat Defense (FTD) Softw
Exploit-DB