CVE-2006-4802: Symantec Client Security

Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days.

Format string vulnerability in the Real Time Virus Scan service in Symantec AntiVirus Corporate Edition 8.1 up to 10.0, and Client Security 1.x up to 3.0, allows local users to execute arbitrary code via an unspecified vector related to alert notification messages, a different vector than CVE-2006-3454, a "second format string vulnerability" as found by the vendor.

Affected products

• Symantec Client Security: version 1.0 only; version 1.0.1 only; version 1.0.1_build_8.01.434 only; version 1.0.1_build_8.01.437 only; version 1.0.1_build_8.01.446 only; version 1.0.1_build_8.01.457 only; …
• Symantec Norton Antivirus: version 8.1 only; version 8.1.1.319 only; version 8.1.1.323 only; version 8.1.1.329 only; version 8.1.1_build8.1.1.314a only; version 9.0 only; …

Published 2006-09-14. Last modified 2026-06-16.