{"id":"CVE-2026-20218","title":"Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability","summary":"A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting i…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-121"],"vendor":"Cisco","product":"Cisco Open Source Snort3","affected":["open_source_snort3 3.12.2.0","open_source_snort3 3.1.2.0","open_source_snort3 3.1.3.0","open_source_snort3 3.1.4.0","open_source_snort3 3.1.5.0","open_source_snort3 3.1.6.0","open_source_snort3 3.1.7.0","open_source_snort3 3.1.8.0","open_source_snort3 3.1.9.0","open_source_snort3 3.1.10.0","open_source_snort3 3.1.12.0","open_source_snort3 3.1.13.0","open_source_snort3 3.1.14.0","open_source_snort3 3.1.15.0","open_source_snort3 3.1.16.0","open_source_snort3 3.1.17.0","open_source_snort3 3.1.18.0","open_source_snort3 3.1.19.0","open_source_snort3 3.1.20.0","open_source_snort3 3.1.21.0","open_source_snort3 3.1.22.0","open_source_snort3 3.1.23.0","open_source_snort3 3.1.24.0","open_source_snort3 3.1.25.0","open_source_snort3 3.1.27.0","open_source_snort3 3.1.28.0","open_source_snort3 3.1.29.0","open_source_snort3 3.1.30.0","open_source_snort3 3.1.31.0","open_source_snort3 3.1.32.0","open_source_snort3 3.1.36.0","open_source_snort3 3.1.38.0","open_source_snort3 3.1.39.0","open_source_snort3 3.1.40.0","open_source_snort3 3.1.41.0","open_source_snort3 3.1.42.0","open_source_snort3 3.1.43.0","open_source_snort3 3.1.45.0","open_source_snort3 3.1.47.0","open_source_snort3 3.1.48.0","open_source_snort3 3.1.50.0","open_source_snort3 3.1.51.0","open_source_snort3 3.1.52.0","open_source_snort3 3.1.53.0","open_source_snort3 3.1.55.0","open_source_snort3 3.1.56.0","open_source_snort3 3.1.57.0","open_source_snort3 3.1.58.0","open_source_snort3 3.1.59.0","open_source_snort3 3.1.60.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T16:12:38.494Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-20218","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9","label":"cisco-sa-snort3-vba-bufdos-jAuFdvn9"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T17:07:51.306Z","slug":"CVE-2026-20218","body":"## Overview\n\nA vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.\n\n## Affected\n\n- `open_source_snort3 3.12.2.0`\n- `open_source_snort3 3.1.2.0`\n- `open_source_snort3 3.1.3.0`\n- `open_source_snort3 3.1.4.0`\n- `open_source_snort3 3.1.5.0`\n- `open_source_snort3 3.1.6.0`\n- `open_source_snort3 3.1.7.0`\n- `open_source_snort3 3.1.8.0`\n- `open_source_snort3 3.1.9.0`\n- `open_source_snort3 3.1.10.0`\n- `open_source_snort3 3.1.12.0`\n- `open_source_snort3 3.1.13.0`\n- `open_source_snort3 3.1.14.0`\n- `open_source_snort3 3.1.15.0`\n- `open_source_snort3 3.1.16.0`\n- `open_source_snort3 3.1.17.0`\n- `open_source_snort3 3.1.18.0`\n- `open_source_snort3 3.1.19.0`\n- `open_source_snort3 3.1.20.0`\n- `open_source_snort3 3.1.21.0`\n- `open_source_snort3 3.1.22.0`\n- `open_source_snort3 3.1.23.0`\n- `open_source_snort3 3.1.24.0`\n- `open_source_snort3 3.1.25.0`\n- `open_source_snort3 3.1.27.0`\n- `open_source_snort3 3.1.28.0`\n- `open_source_snort3 3.1.29.0`\n- `open_source_snort3 3.1.30.0`\n- `open_source_snort3 3.1.31.0`\n- `open_source_snort3 3.1.32.0`\n- `open_source_snort3 3.1.36.0`\n- `open_source_snort3 3.1.38.0`\n- `open_source_snort3 3.1.39.0`\n- `open_source_snort3 3.1.40.0`\n- `open_source_snort3 3.1.41.0`\n- `open_source_snort3 3.1.42.0`\n- `open_source_snort3 3.1.43.0`\n- `open_source_snort3 3.1.45.0`\n- `open_source_snort3 3.1.47.0`\n- `open_source_snort3 3.1.48.0`\n- `open_source_snort3 3.1.50.0`\n- `open_source_snort3 3.1.51.0`\n- `open_source_snort3 3.1.52.0`\n- `open_source_snort3 3.1.53.0`\n- `open_source_snort3 3.1.55.0`\n- `open_source_snort3 3.1.56.0`\n- `open_source_snort3 3.1.57.0`\n- `open_source_snort3 3.1.58.0`\n- `open_source_snort3 3.1.59.0`\n- `open_source_snort3 3.1.60.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}