Vulnerability record · CVE-2012-1462 · published 21 March 2012
CVE-2012-1462: ZIP parser in multiple antivirus products allows malware detection bypass
Ahnlab · V3 Internet Security
The ZIP file parser in numerous antivirus and endpoint protection products mishandles a ZIP archive containing an invalid data block at the beginning, allowing the parser to skip or misread content. Because the affected component is the malware scanner itself, a crafted archive can pass through scanning without being flagged. The record notes it may later be split into separate CVEs if the error proves independent across parser implementations.
Description
The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityThe flaw defeats malware detection but requires a crafted archive and specific conditions, and no confirmed exploitation or KEV listing exists despite a very high EPSS score.
What it is
The ZIP file parser in numerous antivirus and endpoint protection products mishandles a ZIP archive containing an invalid data block at the beginning, allowing the parser to skip or misread content. Because the affected component is the malware scanner itself, a crafted archive can pass through scanning without being flagged. The record notes it may later be split into separate CVEs if the error proves independent across parser implementations.
Impact
An attacker gains the ability to deliver malware inside a ZIP archive that the affected antivirus engine fails to detect, defeating the primary defense on the host. The CVSS 2.0 vector shows integrity impact only (I:P) with no confidentiality or availability impact.
Attack surface
Reached remotely over the network by supplying a crafted ZIP file to a system running one of the affected scanners; the vector AV:N/AC:M/Au:N indicates no authentication is required and some conditions must be met. User interaction is not stated in the record, but delivery of the archive to the scanning path is implied.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.97842, 99.9th percentile), but the reference tags are empty and no public exploit or in-the-wild confirmation is provided in this record.
What to do
- Apply vendor updates for the affected antivirus and endpoint protection products; the record does not list fixed versions, so confirm patched builds with each vendor.
- Do not rely on a single scanner for ZIP inspection; add a second engine or a dedicated archive inspection layer.
- Block or quarantine inbound ZIP archives at the mail and web gateway until scanners are confirmed patched.
- Where feasible, restrict or disable automatic scanning of untrusted archives by the affected engine and route them to sandbox analysis.
- Track the note that this CVE may be split; monitor vendor advisories for per-product identifiers and fixes.
Detection
- Monitor scanner logs for ZIP archives that are opened but return no verdict or an error, especially archives with malformed leading blocks.
- Hunt for files that pass antivirus scanning but later execute or drop payloads, indicating a detection bypass.
- Alert on ZIP files with invalid or truncated data at the start of the archive reaching endpoints or mail gateways.
- Correlate endpoint execution of files extracted from ZIP archives against scanner verdicts to find gaps.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1462 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1462), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
