VBA Decompression Engine Vulnerability in Cisco Products

CVE-2026-20218

What is CVE-2026-20218?

A vulnerability within the Snort 3 Visual Basic for Applications (VBA) Decompression Engine affects multiple Cisco products. This issue arises from improper range checking during the decompression of user-controlled VBA data. An unauthenticated remote attacker can exploit this by sending specially crafted VBA data to the Snort 3 Detection Engine, which may lead to a stack overflow and result in an unexpected restart of the engine. The consequence is a denial of service (DoS) condition, disrupting the normal operation of the affected devices.

References