CVE-2026-20236

The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.

A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.

The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.

Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).

A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.

A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 NetFlow Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing UDP Netflow Protocol packets. Sending a single crafted Netflow packet through an established connection can cause an unexpected restart and DoS condition.