CVE-2005-0249: Symantec Antivirus Scan Engine

High severity, CVSS 7.5. EPSS: 18.8% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative virtual offset to a crafted PE header.

Affected products

• Symantec Antivirus Scan Engine: before 4.3.3 (fixed in 4.3.3)
• Symantec Brightmail Antispam: version 4.0 only; version 5.5 only
• Symantec Client Security: version 1.0.1_build_8.01.434 only; version 1.0.1_build_8.01.437 only; version 1.0.1_build_8.01.446 only; version 1.0.1_build_8.01.457 only; version 1.0.1_build_8.01.460 only; version 1.0.1_build_8.01.464 only; …
• Symantec Gateway Security: version 1.0 only; version 2.0 only; version 2.0.1 only
• Symantec Mail Security: version 4.0 only; version 4.1 only; version 4.5_build_719 only
• Symantec Norton Antivirus: version 2.18_build_83 only; version 8.1.1.319 only; version 8.1.1.323 only; version 8.1.1.329 only; version 8.1.1_build8.1.1.314a only; version 8.01.434 only; …
• Symantec Norton Internet Security: version 2004 only
• Symantec Norton System Works: version 2004 only
• Symantec Sav Filter Domino Nt Ports: version build3.0.5 only
• Symantec Sav Filter For Domino Nt: version 3.1.1 only
• Symantec Web Security: version 3.01.59 only; version 3.01.60 only; version 3.01.61 only; version 3.01.62 only; version 3.01.63 only; version 3.01.67 only; …

Published 2005-02-08. Last modified 2026-06-16.