/
← Voltar ao feed
medium

Cisco Snort 3 VBA Decompression Engine Buffer Overflow (CVE-2026-20218) Allows Unauthenticated Remote DoS

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 2 dias

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed CVE-2026-20218, a stack buffer overflow in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send crafted VBA data to a targeted device, causing the Snort 3 Detection Engine to restart unexpectedly and producing a denial of service. Cisco rates the Security Impact as Medium. The advisory is part of the October 21, 2026 Cisco security advisory bundle. The article does not report exploitation in the wild.

Detalhes técnicos

  • The root cause is improper range checking when Snort 3 decompresses VBA data, which is attacker-controlled.
  • Exploitation causes an overflow of stack data, which leads to a DoS condition.
  • The attack requires no authentication and is performed remotely.

Remediação

  • Cisco has released software updates that address the vulnerability.
  • Cisco states that a workaround exists. Its details are in the advisory cisco-sa-snort3-vba-bufdos-jAuFdvn9.
  • Cisco also published the Open Source Snort 3 Security Hardening Release for October 2026.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:00 primeiro registro só resumo do feed

    Cisco Snort 3 VBA Decompression Engine Buffer Overflow (CVE-2026-20218) Allows Unauthenticated Remote DoS

    ler a análise desta fonte

    Cisco disclosed CVE-2026-20218, a stack buffer overflow in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send crafted VBA data to a targeted device, causing the Snort 3 Detection Engine to restart unexpectedly and producing a denial of service. Cisco rates the Security Impact as Medium. The advisory is part of the October 21, 2026 Cisco security advisory bundle. The article does not report exploitation in the wild.

    Technical Details

    • The root cause is improper range checking when Snort 3 decompresses VBA data, which is attacker-controlled.
    • Exploitation causes an overflow of stack data, which leads to a DoS condition.
    • The attack requires no authentication and is performed remotely.

    Remediation

    • Cisco has released software updates that address the vulnerability.
    • Cisco states that a workaround exists. Its details are in the advisory cisco-sa-snort3-vba-bufdos-jAuFdvn9.
    • Cisco also published the Open Source Snort 3 Security Hardening Release for October 2026.