CVE-2026-20218
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.
Risk Assessment
An attacker could remotely, without authentication, force the Snort 3 Detection Engine to restart, interrupting packet inspection and potentially degrading network security. This could be exploited to disrupt protection systems.
Recommendation
Update Cisco products using Snort 3 to a fixed version. Consider temporarily disabling or restricting VBA data inspection if feasible until the update is applied.
Other vulnerabilities in Snort 3
See all- CVE-2016-1417High
The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.
- CVE-2026-20043Critical
A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.
- CVE-2026-76524High
The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.
- CVE-2026-76489Medium
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.
- CVE-2026-20356High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20291High
Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).
- CVE-2026-20236High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20197Medium
A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.
- CVE-2026-20179Medium
A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.
- CVE-2026-20019Medium
A vulnerability in the Snort 3 NetFlow Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing UDP Netflow Protocol packets. Sending a single crafted Netflow packet through an established connection can cause an unexpected restart and DoS condition.
Original NVD description (English source)
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine of a targeted device. A successful exploit could allow the attacker to cause an overflow of stack data, which could result in a DoS condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS