← Vulnerability feed

Vulnerability record · CVE-2005-0644 · published 2 May 2005

CVE-2005-0644: Mcafee antivirus engine vulnerability

MMcafee · Antivirus Engine

Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field, a variant of CVE-2005-0643.

7.5 CVSS 2.0 High EPSS 7.1% · top 6.0%
7.5CVSS 2.0 base score
7.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute arbitrary code via a malformed LHA file with a type 2 header file name field, a variant of CVE-2005-0643.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://images.mcafee.com/misc/McAfee_Security_Bulletin_05-march-17.pdf Vendor Advisory
http://secunia.com/advisories/14628
http://securitytracker.com/id?1013463
http://www.kb.cert.org/vuls/id/361180 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/10243 Exploit
http://www.securityfocus.com/bid/12832
http://xforce.iss.net/xforce/alerts/id/190 Vendor Advisory
http://images.mcafee.com/misc/McAfee_Security_Bulletin_05-march-17.pdf Vendor Advisory
http://secunia.com/advisories/14628
http://securitytracker.com/id?1013463
http://www.kb.cert.org/vuls/id/361180 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/10243 Exploit
http://www.securityfocus.com/bid/12832
http://xforce.iss.net/xforce/alerts/id/190 Vendor Advisory

Track CVE-2005-0644 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2005-0643Mcafee antivirus engine vulnerabilityBuffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files.EPSS 10%7.5CVE-2004-0937Archive zip vulnerabilitySophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protecti…EPSS 15%7.5CVE-2004-0932McAfee Anti-Virus Engine DATS driver bypass via malformed compressed fileThe McAfee Anti-Virus Engine DATS drivers before 4398 (Oct 13 2004) and DATS Driver before 4397 (Oct 6 2004) fail to properly handle compressed files…EPSS 63%analysed7.5CVE-2004-0933Archive zip vulnerabilityComputer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content M…EPSS 21%7.5CVE-2004-0934Archive zip vulnerabilityKaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, whi…EPSS 15%7.5CVE-2004-0935Archive zip vulnerabilityEset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both local and g…EPSS 15%7.5CVE-2004-0936Archive zip vulnerabilityRAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does…EPSS 15%7.5CVE-2004-1096Broadcom brightstor arcserve backup vulnerabilityArchive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via…EPSS 19%

Source: NIST National Vulnerability Database (record CVE-2005-0644), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.