CVE-2009-0538: Symantec Pcanywhere

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).

Affected products

• Symantec Pcanywhere: up to and including 12.5; version 10.0 only; version 10.5 only; version 11.0 only; version 11.0.1 only; version 11.5 only; …

Published 2009-03-18. Last modified 2026-06-16.