CVE-2009-1348: McAfee Active Virus Defense

High severity, CVSS 7.6. EPSS: 2.8% chance of exploitation in the next 30 days.

The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.

Affected products

• McAfee Active Virus Defense: any version
• McAfee Active Virusscan: any version
• McAfee Email Gateway: any version
• McAfee Internet Security Suite: any version; version 2004 only; version 2005 only; version 2006 only; version 2009 only
• McAfee Securityshield For Email Servers: any version
• McAfee Securityshield For Microsoft Isa Server: any version
• McAfee Securityshield For Microsoft SharePoint: any version
• McAfee Total Protection: version 2009 only
• McAfee Total Protection For Endpoint: any version
• McAfee Virusscan Commandline: any version
• McAfee Virusscan Enterprise: any version; affected versions not specified
• McAfee Virusscan Plus: version 2009 only
• McAfee Virusscan USB: any version

Published 2009-04-30. Last modified 2026-06-16.