How severe is CVE-2015-8841?

CVE-2015-8841 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2015-8841 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-8841?

CVE-2015-8841 primarily affects Eset Nod32. In total, 907 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-8841?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2015-8841 published?

CVE-2015-8841 was published on 2016-04-12 and last updated on 2026-06-17.

CVE-2015-8841

CVE-2015-8841 is a critical-severity vulnerability in Eset Nod32 with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 9% (95th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-787
Affected product: Eset Nod32
Published: 2016-04-12
Last modified: 2026-06-17

Description

Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.

Frequently asked questions

What is CVE-2015-8841?: Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
How severe is CVE-2015-8841?: CVE-2015-8841 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2015-8841 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (95th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-8841?: CVE-2015-8841 primarily affects Eset Nod32. In total, 907 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-8841?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2015-8841 published?: CVE-2015-8841 was published on 2016-04-12 and last updated on 2026-06-17.

References

Affected products (907)

cpe:2.3:a:eset:nod32:-:10951:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10952:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10953:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10954:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10955:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10956:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10957:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10958:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10959:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10960:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10961:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10962:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10963:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10964:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10965:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10966:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10967:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10968:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10969:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10970:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10971:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10972:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10973:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10974:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10975:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10976:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10977:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10978:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10979:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10980:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10981:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10982:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10983:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10984:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10985:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10986:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10987:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10988:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10989:*:*:*:*:*:*
cpe:2.3:a:eset:nod32:-:10990:*:*:*:*:*:*

More vulnerabilities in Eset Nod32

CVE-2023-3160 — High (CVSS 7.8): The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete…
CVE-2024-3779 — Medium (CVSS 6.1): Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker…

All CVEs affecting Eset Nod32 →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is…
CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →