Vulnerability record · CVE-2005-2856 · published 8 September 2005

CVE-2005-2856: Winace memory buffer overflow vulnerability

Winace · Winace

Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including (1) ALZip 5.51 through 6.11, (2) Servant Salamander 2.0 and 2.5 Beta 1, (3) WinHKI 1.66 and 1.67, (4) ExtractNow 3.x, (5) Total Commander 6.53, (6) Anti-Trojan 5.5.421, (7) PowerArchiver before 9.61, (8) UltimateZip 2.7,1, 3.0.3, and 3.1b, (9) Where Is It (WhereIsIt) 3.73.501, (10) FilZip 3.04, (11) IZArc 3.5 beta3, (12) Eazel 1.0, (13) Rising Antivirus 18.27.21 and earlier, (14) AutoMate 6.1.0.0, (15) BitZipper 4.1 SR-1, (16) ZipTV, and other products, allows user-assisted attackers to execute arbitrary code via a long filename in an ACE archive.

7.5 CVSS 2.0 High EPSS 16% · top 3.3% CWE-119 · Memory buffer overflow

7.5CVSS 2.0 base score

16%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

168References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Winace Winace

References

Link	Tags
http://marc.info/?l=bugtraq&m=112621008228458&w=2
http://secunia.com/advisories/16479	PatchVendor Advisory
http://secunia.com/advisories/19454	Vendor Advisory
http://secunia.com/advisories/19458	Vendor Advisory
http://secunia.com/advisories/19581	Vendor Advisory
http://secunia.com/advisories/19596
http://secunia.com/advisories/19612
http://secunia.com/advisories/19834	Vendor Advisory
http://secunia.com/advisories/19890	Vendor Advisory
http://secunia.com/advisories/19931
http://secunia.com/advisories/19938	Vendor Advisory
http://secunia.com/advisories/19939
http://secunia.com/advisories/19967	Vendor Advisory
http://secunia.com/advisories/19975	Vendor Advisory
http://secunia.com/advisories/19977	Vendor Advisory
http://secunia.com/advisories/20009	Vendor Advisory
http://secunia.com/advisories/20270
http://secunia.com/secunia_research/2005-41/advisory/
http://secunia.com/secunia_research/2006-24/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-25/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-27/	Vendor Advisory
http://secunia.com/secunia_research/2006-28/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-29/advisory/	Vendor Advisory
http://secunia.com/secunia_research/2006-30/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-32/advisory/
http://secunia.com/secunia_research/2006-33/advisory/	Vendor Advisory
http://secunia.com/secunia_research/2006-36/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-38/advisory	Vendor Advisory
http://secunia.com/secunia_research/2006-46/advisory/
http://secunia.com/secunia_research/2006-50/advisory/
http://securityreason.com/securityalert/49
http://securitytracker.com/id?1014863
http://securitytracker.com/id?1015852
http://securitytracker.com/id?1016011
http://securitytracker.com/id?1016012
http://securitytracker.com/id?1016065
http://securitytracker.com/id?1016066
http://securitytracker.com/id?1016088
http://securitytracker.com/id?1016114
http://securitytracker.com/id?1016115

Track CVE-2005-2856 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-6563Winace memory buffer overflow vulnerabilityHeap-based buffer overflow in WinAce 2.65 and earlier, and possibly other versions before 2.69, allows user-assisted remote attackers to execute arbi…EPSS 5.5%28 Dec 2007 7.8CVE-2007-1673Amavis vulnerabilityunzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a …EPSS 3.2%9 May 2007 7.8CVE-2007-2535Winace vulnerabilityWinAce allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous fil…EPSS 2.7%9 May 2007 7.5CVE-2005-2694Winace vulnerabilityBuffer overflow in WinAce 2.6.0.5, and possibly earlier versions, allows remote attackers to execute arbitrary code via a temporary (.tmp) file that …EPSS 3.9%26 Aug 2005 5.1CVE-2006-0813Winace memory buffer overflow vulnerabilityHeap-based buffer overflow in WinACE 2.60 allows user-assisted attackers to execute arbitrary code via a large header block in an ARJ archive.EPSS 3.2%24 Feb 2006 8.8CVE-2026-8452Citrix NetScaler ADC and Gateway memory buffer overflow causes DoSCVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that leads to unpredictable or erroneous behavior a…KEVEPSS 1.0%analysed30 Jun 2026 8.8CVE-2009-3459Adobe Reader and Acrobat heap buffer overflow via crafted PDFAdobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 contain a heap-based buffer overflow (CWE-122) triggered by a crafted…KEVEPSS 87%analysed13 Oct 2009 9.8CVE-2008-4250Microsoft Windows Server service RPC path canonicalization buffer overflowThe Server service in multiple Windows versions fails to properly handle path canonicalization, allowing a crafted RPC request to overflow a buffer a…KEVEPSS 99%analysed23 Oct 2008

Source: NIST National Vulnerability Database (record CVE-2005-2856), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.