EUVD-2026-43670
GHSA-h467-wgwr-q697
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N as attack is delivered over the network to the HX console; PR:L because authentication is required; AC:H for specialized payload construction; A:H for full DoS; no C or I impact.
Primary rating from Vendor (trellix).
CVSS VectorVendor: trellix
Lifecycle Timeline
1DescriptionCVE.org
An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service.
AnalysisAI
Denial of Service in Trellix HX (versions 10.0.0 and earlier) allows an authenticated network attacker to exhaust appliance resources by submitting a specially crafted highly-compressed file to the HX console, triggering the product's own detection engine to perform runaway decompression. The impact is limited to availability - the EDR appliance becomes unresponsive - but disruption of an endpoint detection and response platform carries secondary operational risk by creating a monitoring blind spot. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Technical ContextAI
CWE-409 (Improper Handling of Highly Compressed Data) covers the 'decompression bomb' or 'zip bomb' class of vulnerability, where a small compressed artifact expands by orders of magnitude when decompressed, rapidly consuming CPU cycles and memory. Trellix HX is the endpoint detection and response (EDR) platform formerly known as FireEye HX; it inspects submitted files and endpoint telemetry through a detection pipeline. The irony here is that the detection engine itself - designed to identify malicious archives - is the vulnerable component: submitting a crafted payload causes the scanner to trigger uncontrolled decompression. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N) confirms network delivery but requires authenticated access and exhibits high attack complexity, indicating that triggering the specific decompression code path likely demands knowledge of how the HX detection pipeline processes archive formats. No CPE string was provided in the available intelligence data.
RemediationAI
The primary remediation is to apply the vendor-released update referenced in the Trellix PSIRT advisory at https://support.trellix.com/s/article/000015595. No specific patched version number was confirmed in the available intelligence data - the advisory must be consulted directly to determine the target upgrade version. As a compensating control while patching, restrict access to the HX console to the minimum set of required user accounts and enforce strong credential hygiene, reducing the likelihood that low-privilege credentials sufficient to trigger the vulnerability can be obtained by an attacker. Additionally, implement network access controls to limit which hosts can reach the HX console interface, constraining the attack surface to trusted management networks. Note that restricting console access may reduce operational flexibility during the interim period, and overly aggressive network controls could impair legitimate EDR telemetry flows.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today