CVE-2012-1460: Gzip parser in multiple antivirus engines allows malware detection bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityIt is a detection bypass rather than direct code execution (CVSS 4.3), but it affects many widely deployed scanners and carries a very high EPSS score.

What it is

The Gzip file parser in several antivirus products mishandles .tar.gz archives containing stray bytes at the end, allowing malware to evade detection. The flaw affects multiple independent engines (Antiy AVL SDK, Quick Heal, Command Antivirus, eSafe, F-Prot, Jiangmin, K7, VBA32), so a single crafted archive can slip past several scanners at once. It matters because detection bypass undermines the core protective function of these products.

Impact

An attacker can deliver a malicious .tar.gz that the affected scanner fails to flag, letting malware reach the endpoint or mail gateway undetected. The attacker gains no code execution from the flaw itself, only evasion of the antivirus check.

Attack surface

Reached remotely by supplying a crafted .tar.gz file to a system whose antivirus engine parses it, such as through email attachments, web downloads or file uploads. No authentication is required, but some user or automated action to deliver and scan the file is needed (AV:N/AC:M/Au:N).

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, though EPSS is very high (0.944, 99.8th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply vendor updates for each affected antivirus engine; the record does not list fixed versions, so confirm with each vendor.
• Where no fix exists, disable or restrict automatic parsing of .tar.gz archives by the scanner and route them to a secondary inspection tool.
• Add independent detection layers (sandboxing, YARA or signature checks outside the affected parser) so a single bypass does not result in delivery.
• Block or quarantine .tar.gz attachments at the mail and web gateway unless explicitly required.
• Track the NVD note that this CVE may be split per implementation and re-check advisories for each product.

Detection

• Monitor for .tar.gz files with trailing stray bytes after the gzip stream and alert on scanner results that return clean for such files.
• Correlate antivirus scan logs with file delivery events to find archives that pass scanning but later execute or drop payloads.
• Hunt for repeated submissions of malformed .tar.gz archives to mail gateways or upload endpoints from the same source.
• Review endpoint telemetry for processes spawned from extracted archive contents that were never flagged by the local scanner.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.