CVE-2012-1461: Gzip parser in multiple antivirus products allows malware detection bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw only bypasses detection rather than granting code execution, but it affects a very broad set of security products and carries a high EPSS score.

What it is

The Gzip file parser in numerous antivirus and anti-malware products mishandles .tar.gz files containing multiple compressed streams, allowing a crafted archive to evade malware detection. Because the affected component is the scanner itself, a bypass undermines the core protection these products are meant to provide. The record notes it may later be split into separate CVEs if the error proves independent across parser implementations.

Impact

An attacker can deliver malware inside a specially crafted .tar.gz that the affected scanner fails to detect, so malicious content reaches the endpoint or gateway unchecked. The attacker gains no code execution from the flaw itself, only evasion of the detection layer.

Attack surface

Reached remotely by supplying a crafted .tar.gz file to a scanning product, such as through email, web or file transfer inspection. No authentication is required, but the CVSS vector indicates medium attack complexity and no user interaction is specified.

Exploitation

Not listed in CISA KEV and no reference tags indicate known exploitation, though EPSS is very high at roughly 0.917 (99.8th percentile), suggesting elevated predicted likelihood. No public exploit or in-the-wild use is confirmed by the supplied record.

What to do

• Apply vendor updates for the affected antivirus and anti-malware products; this is a 2012 issue, so confirm current versions are not still affected.
• Where a patch is unavailable, disable or restrict automatic scanning of .tar.gz archives or route them to a secondary detection engine.
• Layer detection with a second, independently implemented scanner so a single parser bypass does not result in a miss.
• Block or quarantine inbound .tar.gz attachments and downloads at the gateway until scanners are confirmed fixed.
• Re-scan historical quarantine and mail archives with updated engines to catch previously missed multi-stream archives.

Detection

• Monitor scanner logs for .tar.gz files that pass inspection but later execute or trigger endpoint alerts.
• Hunt for archives containing multiple gzip streams or concatenated members reaching mail and web gateways.
• Correlate gateway scan verdicts with endpoint detection events to find files that bypassed the initial scan.
• Track vendor advisories and version inventories to identify endpoints still running the listed 2012-era engine versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.