CVE-2008-6904: Sophos Anti-Virus

High severity, CVSS 10.0. EPSS: 10.6% chance of exploitation in the next 30 days.

Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via crafted files that have been packed with (1) armadillo, (2) asprotect, or (3) asprotectSKE.

Affected products

• Sophos Anti-Virus: version 4.7.18 only; version 4.9.18 only; version 4.37.0 only; version 6.4.5 only; version 7.0.5 only
• Sophos Anti-VIRUS7.6.3: any version

Published 2009-08-06. Last modified 2026-06-16.