Vulnerability record · CVE-2012-1435 · published 21 March 2012
CVE-2012-1435: Antivirus EXE parsers bypassed via crafted PKLITE marker
Ahnlab · V3 Internet Security
The EXE file parser in several antivirus products (AhnLab V3 Internet Security, Emsisoft Anti-Malware, eSafe, Ikarus Virus Utilities T3, Panda Antivirus) can be tricked into missing malware by placing a \50\4B\4C\49\54\45 ("PKLITE") character sequence at a specific location in an EXE file. This lets a malicious executable evade detection, undermining the core protective function of the affected scanners.
Description
The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \50\4B\4C\49\54\45 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityCVSS 2.0 is 4.3 (MEDIUM) and impact is limited to detection bypass, but the very high EPSS score and the security-critical nature of antivirus parsers raise concern.
What it is
The EXE file parser in several antivirus products (AhnLab V3 Internet Security, Emsisoft Anti-Malware, eSafe, Ikarus Virus Utilities T3, Panda Antivirus) can be tricked into missing malware by placing a \50\4B\4C\49\54\45 ("PKLITE") character sequence at a specific location in an EXE file. This lets a malicious executable evade detection, undermining the core protective function of the affected scanners.
Impact
An attacker can deliver an EXE that the affected antivirus engines fail to flag, allowing malware to run on a protected host. The gain is detection bypass, not direct code execution or privilege escalation.
Attack surface
Reached remotely over the network by supplying a crafted EXE file to the scanner (AV:N, AC:M, Au:N per CVSS 2.0). No authentication is required; user interaction is not specified in the record.
Exploitation
Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is very high (0.93594, 99.8th percentile), indicating strong predicted exploitation activity.
What to do
- Apply vendor updates for the affected antivirus products; the record does not list fixed versions, so confirm with each vendor.
- Where no fix is available, replace or supplement the affected scanner with an engine that correctly parses the PKLITE marker.
- Block or quarantine EXE files containing the \50\4B\4C\49\54\45 sequence at the parser-relevant offset at the mail and web gateway.
- Reduce reliance on a single AV engine for EXE inspection; add sandbox detonation or second-opinion scanning.
- Monitor vendor advisories for a possible CVE split, since the record notes the issue may be separated per parser implementation.
Detection
- Scan inbound and stored EXE files for the byte sequence 50 4B 4C 49 54 45 at the location referenced in the parser logic.
- Alert on EXE files that pass AV clean but exhibit packing or PKLITE-style markers inconsistent with their declared type.
- Correlate endpoint execution of EXE files that were not flagged by the installed AV engine with subsequent suspicious behavior.
- Review AV engine version inventory to identify hosts still running the affected builds.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1435 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1435), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
