CVE-2012-1459: TAR parser malware detection bypass in multiple antivirus products

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityCVSS 2.0 is 4.3 (MEDIUM) and the flaw only bypasses detection rather than executing code, but it affects a very broad set of security products and EPSS is extremely high.

What it is

The TAR file parser in dozens of antivirus products mishandles a TAR archive entry whose length field spans the entire entry plus part of the next entry's header. This lets a crafted archive evade malware detection, so malicious content passes through scanning undetected. The record covers many independent vendor implementations and may later be split into separate CVEs.

Impact

An attacker can deliver malware inside a crafted TAR archive that the affected scanner fails to flag, defeating the primary detection control. No code execution or data modification on the scanner host is described; the gain is evasion of malware detection.

Attack surface

Reached remotely by supplying a malicious TAR archive to a scanning interface, as reflected by the AV:N network vector. No authentication is required (Au:N), but exploitation depends on the target processing the crafted archive, which the AC:M vector indicates is not fully reliable.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, though EPSS is very high (0.998, 99.96th percentile). The record does not confirm public exploit availability.

What to do

• Apply vendor updates for the affected antivirus and scanning engines; this is a 2012 issue, so confirm current versions are not still affected.
• Where a vendor never patched, replace or upgrade the affected TAR parsing component or scanning engine.
• Do not rely on a single AV engine for TAR archives; add a second, independently implemented scanner or sandbox detonation.
• Block or quarantine inbound TAR archives at mail and web gateways until scanning is verified against crafted-entry test cases.
• Re-test detection with a TAR archive containing an entry length field that overlaps the next entry header.

Detection

• Hunt for TAR archives whose entry length fields extend beyond the entry into the following header, using a parser that logs such anomalies.
• Monitor AV and gateway logs for archives that pass scanning but later trigger endpoint alerts or sandbox detonation.
• Alert on TAR files arriving from external sources that contain executables or scripts, regardless of scan verdict.
• Track scanner engine versions against vendor advisories for this TAR parsing flaw.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.