CVE-2012-1456: Antivirus TAR parsers bypassed by appended ZIP file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityIt is a detection bypass requiring a crafted file and medium attack complexity, with no KEV listing, though the very high EPSS and broad product exposure keep it relevant.

What it is

Multiple antivirus products parse TAR archives in a way that lets a TAR file with an appended ZIP evade malware detection. An attacker can therefore deliver a malicious ZIP payload that the scanner does not inspect, undermining the core function of the endpoint protection. The record notes it may later be split into separate CVEs if the error proves independent across implementations.

Impact

An attacker gains a way to smuggle malware past the affected antivirus engines, so malicious content reaches the host without being flagged. The flaw is a detection bypass, not code execution in the scanner itself.

Attack surface

Reached remotely by supplying a crafted TAR file with an appended ZIP, typically through file scanning or mail/web content inspection. No authentication is required; the CVSS vector AV:N/AC:M/Au:N indicates network delivery with medium complexity and no user account, though some user action to open or scan the file is implied.

Exploitation

Not listed in CISA KEV and no reference tags indicate known exploitation, but EPSS is very high (0.99934, 99.97th percentile), suggesting elevated predicted likelihood. No public exploit details are provided in the record.

What to do

• Apply vendor updates for the affected antivirus engines; the record does not list fixed versions, so confirm with each vendor.
• Where no fix exists, disable or restrict TAR scanning paths or route suspicious archives to a second, independent scanner.
• Enforce layered detection (network and endpoint) so a single parser bypass does not equal full evasion.
• Block or quarantine TAR files with appended ZIP data at mail and web gateways.
• Track vendor advisories for the possible CVE split, as fixes may be issued per product.

Detection

• Alert on TAR files containing appended ZIP signatures (PK\x03\x04 after the TAR end-of-archive marker).
• Monitor for archive files that pass gateway inspection but are flagged by a second engine or sandbox.
• Log and review antivirus scan results for TAR/ZIP polyglot files that return clean despite embedded executables.
• Correlate endpoint detections of ZIP-borne malware with prior clean scans of the same file.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.