Cisco Snort OLE VBA bug allows unauthenticated remote code execution
Original title: ZDI-26-788: Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI rates stack-overflow CVE-2026-20218 at CVSS 8.1 and says authentication is not required.
ZDI advisory ZDI-26-788 describes a stack-based buffer overflow in Cisco Snort's OLE VBA decompression. Remote attackers can execute arbitrary code without authentication. ZDI assigned CVSS 8.1 and CVE-2026-20218. The notice does not list affected or fixed versions or say whether attacks are underway.
Unconfirmed: Affected versions, fixes, and exploitation status are not stated.
- The flaw is in OLE VBA decompression.
- Authentication is not required to exploit it.
- ZDI's CVSS score is 8.1.
- The advisory identifier is ZDI-26-788.
Impact: unauthenticated remote code execution
| Product | Affected |
|---|---|
| Cisco Snort | — |
- CVEs
- CVE-2026-20218
- Vendors
- Cisco
- Products
- Snort
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20218 | A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote… | 5.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.