OTPulse

Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability

MonitorCVSS 5.8cisco-sa-snort3-vba-bufdos-jAuFdvn9Oct 21, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine in multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service condition. The vulnerability is due to improper range checking when Snort 3 decompresses VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine, causing a stack buffer overflow that results in a DoS condition. VBA decompression is not enabled by default for any Snort 3 Inspector.

What this means
What could happen
If your Snort 3 intrusion detection system processes crafted VBA-formatted files, an attacker could crash the Snort detection engine, causing it to restart and temporarily interrupt threat detection until it recovers.
Who's at risk
Organizations running Cisco Snort 3 intrusion detection on firewalls, appliances, or security gateways should verify whether VBA decompression is enabled. This matters for sectors like finance, healthcare, and utilities that rely on Snort for threat detection on their perimeter or internal networks.
How it could be exploited
An attacker sends a specially crafted VBA file to a network location or application monitored by your Snort 3 detection engine. When Snort 3 attempts to decompress the VBA data, improper range checking causes a stack buffer overflow, crashing the detection engine and triggering an unexpected restart.
Prerequisites
  • Snort 3 must have VBA decompression explicitly enabled in the intrusion policy
  • Network access to deliver crafted VBA data to a monitored interface or application
  • Snort 3 version 17.12.1a through 3.9.7.0
remotely exploitableno authentication requiredlow complexityaffects threat detection continuity
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Multiple Cisco Products Snort 3 Visual Basic for Applications17.12.1a through 3.9.7.0Fix available
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDDisable VBA decompression in all Snort 3 intrusion policies until patches can be applied
HARDENINGReview and document which Snort 3 policies currently have VBA decompression enabled
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade Snort 3 to version 3.9.8.0 or later on all affected Cisco products
View full vendor advisory
API: /api/v1/advisories/743c5373-9a7f-4e28-939e-a5d027117a88

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.