CVE-2005-0249

CVE-2005-0249 is a high-severity vulnerability in Symantec Antivirus Scan Engine with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 19% places it in the 97th percentile, indicating an elevated likelihood of exploitation.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 19% (97th percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Symantec Antivirus Scan Engine
• Published: 2005-02-08
• Last modified: 2026-06-16

Description

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.

Frequently asked questions

What is CVE-2005-0249?

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.

How severe is CVE-2005-0249?

CVE-2005-0249 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2005-0249 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 19% (97th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2005-0249?

CVE-2005-0249 primarily affects Symantec Antivirus Scan Engine. In total, 49 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2005-0249?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2005-0249 published?

CVE-2005-0249 was published on 2005-02-08 and last updated on 2026-06-16.

References

• http://securitytracker.com/id?1013133
• http://www.kb.cert.org/vuls/id/107822
• http://www.symantec.com/avcenter/security/Content/2005.02.08.html
• http://xforce.iss.net/xforce/alerts/id/187
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18869

Affected products (49)

• cpe:2.3:a:symantec:antivirus_scan_engine:*:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:brightmail_antispam:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:brightmail_antispam:5.5:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.434:mr3:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.437:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.446:mr4:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.457:mr5:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.460:mr6:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.464:mr7:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.0.1_build_8.01.471:mr8:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.1.1_mr1_build_8.1.1.314a:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.1.1_mr2_build_8.1.1.319:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.1.1_mr3_build_8.1.1.323:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.1.1_mr4_build_8.1.1.329:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:client_security:1.1.1_mr5_build_8.1.1.336:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:gateway_security:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:gateway_security:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:gateway_security:2.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:mail_security:4.0:*:domino:*:*:*:*:*
• cpe:2.3:a:symantec:mail_security:4.1:build_458:exchange:*:*:*:*:*
• cpe:2.3:a:symantec:mail_security:4.1:build_459:exchange:*:*:*:*:*
• cpe:2.3:a:symantec:mail_security:4.1:build_461:exchange:*:*:*:*:*
• cpe:2.3:a:symantec:mail_security:4.5_build_719:*:exchange:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:2.18_build_83:*:exchange:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.1.1.319:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.1.1.323:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.1.1.329:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.1.1_build8.1.1.314a:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.434:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.437:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.446:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.457:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.460:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.464:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:8.01.471:*:corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:9.0:*:macintosh_corporate:*:*:*:*:*
• cpe:2.3:a:symantec:norton_antivirus:2004:*:windows:*:*:*:*:*
• cpe:2.3:a:symantec:norton_internet_security:2004:*:professional:*:*:*:*:*
• cpe:2.3:a:symantec:norton_system_works:2004:*:windows:*:*:*:*:*
• cpe:2.3:a:symantec:sav_filter_domino_nt_ports:build3.0.5:*:aix:*:*:*:*:*

More vulnerabilities in Symantec Antivirus Scan Engine

• CVE-2006-0230 — Critical (CVSS 10.0): Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a…
• CVE-2005-2758 — Critical (CVSS 10.0): Integer signedness error in the administrative interface for Symantec AntiVirus Scan Engine 4.0 and 4.3 allows remote…
• CVE-2007-0447 — Critical (CVSS 9.3): Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute…
• CVE-2007-3699 — Critical (CVSS 9.3): The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite…
• CVE-2004-0217 — High (CVSS 7.0): The LiveUpdate capability (liveupdate.sh) in Symantec AntiVirus Scan Engine 4.0 and 4.3 for Red Hat Linux allows local…
• CVE-2006-0231 — Medium (CVSS 6.4): Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses the same private DSA key for each…

All CVEs affecting Symantec Antivirus Scan Engine →