CVE-2012-1442: Multiple antivirus ELF parsers allow malware detection bypass via modified class field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityThe bypass weakens malware detection across many widely deployed scanners, but it grants no direct code execution and CVSS rates it only 4.3.

What it is

The ELF file parser in numerous antivirus products (Quick Heal, McAfee, eSafe, Kaspersky, F-Secure, Sophos, Antiy AVL SDK, Rising, Fortinet, Panda) mishandles the ELF class field, letting a crafted ELF file evade malware detection. Because these engines sit in the scanning path for email, web and file transfers, a bypass undermines the core protection they provide. The record notes it may later be split into separate CVEs if the flaw proves independent across implementations.

Impact

An attacker can deliver a malicious ELF binary that the affected scanners fail to flag, allowing malware to reach the endpoint or pass through a gateway undetected. The flaw itself gives no code execution or data access; the gain is evasion of detection.

Attack surface

Reached remotely by supplying a crafted ELF file to a system or gateway running one of the listed scanning engines, per the AV:N vector. No authentication is required (Au:N), though the CVSS AC:M rating implies some conditions must be met for the bypass to succeed.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is very high (0.98917, 99.9th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply vendor updates for each affected antivirus/scanning engine; treat the listed versions as the affected baseline and confirm fixed builds with each vendor.
• Where no fix is available, disable or restrict ELF scanning reliance for untrusted sources and add a second detection layer (sandboxing, YARA, or endpoint behavioral controls).
• Block or quarantine inbound ELF files at mail and web gateways unless explicitly required by business need.
• Monitor vendor advisories for the possible CVE split, since individual products may receive separate fixes and severity ratings.

Detection

• Hunt for ELF files with inconsistent or unusual class field values (e.g., class byte not matching expected 32/64-bit layout) arriving via email or web downloads.
• Correlate gateway scan logs showing clean verdicts with subsequent endpoint execution of ELF binaries from external sources.
• Alert on ELF files delivered to Windows-centric environments where ELF execution is unexpected.
• Track vendor patch levels for the listed scanning engines and flag hosts still running the affected versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.