Vulnerability record · CVE-2012-4953 · published 14 November 2012

CVE-2012-4953: Symantec antivirus memory buffer overflow vulnerability

Symantec · Antivirus

The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corporate Edition (SAVCE) 10.x, and Symantec Scan Engine (SSE) before 5.2.8 does not properly perform bounds checks of the contents of CAB archives, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted file.

9.3 CVSS 2.0 High EPSS 6.0% · top 6.9% CWE-119 · Memory buffer overflow

9.3CVSS 2.0 base score

6.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

3Affected product versions listed by NVD

8References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Antivirus Symantec

Endpoint Protection Symantec

Scan Engine Symantec

References

Link	Tags
http://www.kb.cert.org/vuls/id/985625	US Government Resource
http://www.securityfocus.com/bid/56399
http://www.securitytracker.com/id?1027726
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2
http://www.kb.cert.org/vuls/id/985625	US Government Resource
http://www.securityfocus.com/bid/56399
http://www.securitytracker.com/id?1027726
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2

Track CVE-2012-4953 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0108Symantec antivirus memory buffer overflow vulnerabilityBuffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9…EPSS 19%19 Feb 2010 10.0CVE-2009-1429Symantec AMS2 Intel LANDesk CBA Remote Command ExecutionThe Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2) passes crafted packet contents directly to the CreateProcessA …EPSS 88%analysed29 Apr 2009 9.8CVE-2016-3645Symantec norton security vulnerabilityInteger overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:…EPSS 25%30 Jun 2016 9.3CVE-2012-0295Symantec endpoint protection code injection vulnerabilityThe Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-…EPSS 4.0%23 May 2012 9.3CVE-2011-0688Symantec antivirus improper authentication vulnerabilityIntel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Cente…EPSS 4.0%31 Jan 2011 9.3CVE-2010-0111Symantec antivirus improper input validation vulnerabilityHDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in S…EPSS 35%31 Jan 2011 9.3CVE-2009-1430Symantec Alert Management System IAO.EXE stack buffer overflowIAO.EXE in the Symantec Alert Originator Service (Alert Management System 2, shipped with System Center, AntiVirus, Client Security and Endpoint Prot…EPSS 55%analysed29 Apr 2009 9.3CVE-2009-1431Symantec antivirus vulnerabilityXFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Syma…EPSS 8.0%29 Apr 2009

Source: NIST National Vulnerability Database (record CVE-2012-4953), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.