Vulnerability record · CVE-2019-7651 · published 8 February 2019

CVE-2019-7651: Emsisoft anti-malware vulnerability

Emsisoft · Anti Malware

EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not properly protected, leading to unintended impersonation or object creation. This vulnerability has been fixed in version 2018.12 and later.

7.5 CVSS 3.0 High EPSS 4.9% · top 8.2%

7.5CVSS 3.0 base score, v2 5.0

4.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Anti Malware Emsisoft

References

Link	Tags
https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/	Release NotesVendor Advisory
https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-01-09-emsisoft-Anti-Malware-bypass.md	ExploitThird Party Advisory
https://help.emsisoft.com/en/1760/vulnerability-report-en/	Vendor Advisory
https://nafiez.github.io/security/bypass/2019/01/08/emsisoft-Anti-Malware-bypass.html	ExploitThird Party Advisory
https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/	Release NotesVendor Advisory
https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-01-09-emsisoft-Anti-Malware-bypass.md	ExploitThird Party Advisory
https://help.emsisoft.com/en/1760/vulnerability-report-en/	Vendor Advisory
https://nafiez.github.io/security/bypass/2019/01/08/emsisoft-Anti-Malware-bypass.html	ExploitThird Party Advisory

Track CVE-2019-7651 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

4.3CVE-2012-1456Antivirus TAR parsers bypassed by appended ZIP fileMultiple antivirus products parse TAR archives in a way that lets a TAR file with an appended ZIP evade malware detection. An attacker can therefore …EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1457Antivirus TAR parser malware detection bypass via oversized length fieldThe TAR file parser in numerous antivirus and anti-malware products mishandles a TAR archive entry whose length field exceeds the total TAR file size…EPSS 98%analysed21 Mar 2012 4.3CVE-2012-1459TAR parser malware detection bypass in multiple antivirus productsThe TAR file parser in dozens of antivirus products mishandles a TAR archive entry whose length field spans the entire entry plus part of the next en…EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1461Gzip parser in multiple antivirus products allows malware detection bypassThe Gzip file parser in numerous antivirus and anti-malware products mishandles .tar.gz files containing multiple compressed streams, allowing a craf…EPSS 92%analysed21 Mar 2012 4.3CVE-2012-1462ZIP parser in multiple antivirus products allows malware detection bypassThe ZIP file parser in numerous antivirus and endpoint protection products mishandles a ZIP archive containing an invalid data block at the beginning…EPSS 98%analysed21 Mar 2012 4.3CVE-2012-1443RAR parser malware detection bypass in multiple antivirus enginesThe RAR file parser in dozens of antivirus products fails to correctly handle a RAR archive whose contents begin with an MZ character sequence, allow…EPSS 100%analysed21 Mar 2012 4.3CVE-2012-1448CAB parser malware detection bypass in multiple antivirus productsThe CAB file parser in Quick Heal 11.00, Trend Micro AntiVirus 9.120.0.1004, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Trend Micro Hou…EPSS 89%analysed21 Mar 2012 4.3CVE-2012-1450CAB parser malware detection bypass in Emsisoft, Sophos and Ikarus scannersThe CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Sophos Anti-Virus 4.61.0 and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 can be eva…EPSS 74%analysed21 Mar 2012

Source: NIST National Vulnerability Database (record CVE-2019-7651), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.