CVE-2007-2864: CA Anti-Virus engine stack buffer overflow via crafted CAB file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution with complete confidentiality, integrity and availability impact, high EPSS, and a wide affected product set, though no confirmed in-the-wild exploitation is recorded.

What it is

The Anti-Virus engine in multiple CA (Computer Associates) products before content update 30.6 has a stack-based buffer overflow triggered by a large invalid value in the coffFiles field of a .CAB file. Because the flaw sits in the scanning engine itself, any product that hands a CAB file to that engine can be affected, making it a broad issue across CA's antivirus and related product lines.

Impact

A remote attacker can execute arbitrary code in the context of the process that scans the malicious CAB file, which for antivirus and backup products is often a privileged service. Successful exploitation can lead to full system compromise.

Attack surface

Reached remotely by delivering a crafted .CAB file that the CA Anti-Virus engine parses, for example through email, web download, or file scanning paths. No authentication is required, but the CVSS vector indicates medium access complexity, and some user or automated action is needed to get the file scanned.

Exploitation

Not listed in CISA KEV and no ransomware groups are documented using it, but EPSS is high at roughly 0.50 (98.8th percentile), and references include vendor and ZDI advisories plus patch tags.

What to do

• Apply the vendor content update 30.6 or later, or the corresponding product patch, as the primary fix.
• Block or quarantine .CAB files at email and web gateways until all affected CA products are updated.
• Restrict scanning services and backup agents from running with unnecessary privileges to limit the impact of code execution.
• Retire or isolate end-of-life CA/Broadcom products that can no longer receive content updates.
• Monitor vendor advisories for updated guidance on affected product versions.

Detection

• Inspect CAB files for malformed or oversized coffFiles field values before they reach the scanning engine.
• Monitor antivirus and backup service processes for unexpected crashes or child process creation during file scans.
• Alert on unusual outbound network connections or process behavior originating from CA/Broadcom scanning services.
• Review logs for repeated scan failures or restarts tied to CAB file processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.