CVE-2026-20054

Published: Mar 4, 2026Modified: Aug 20, 2026

5.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: psirt@cisco.com (Secondary)

Description

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.

Affected (194)

Products: Cisco: Snort, Cyber Vision, Secure Firewall Threat Defense, Unified Threat Defense Snort Intrusion Prevention System Engine

Cisco

4 products

Snort

Cyber Vision

Secure Firewall Threat Defense

Unified Threat Defense Snort Intrusion Prevention System Engine

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cisco Snort	From 3.0.0-233 to 3.9.3.0

Configuration B

53 vulnerable

Vulnerable Software	Affected Versions
Cisco Cyber Vision	Version 3.0.0
Cisco Cyber Vision	Version 3.0.1
Cisco Cyber Vision	Version 3.0.2
Cisco Cyber Vision	Version 3.0.3
Cisco Cyber Vision	Version 3.0.4
Cisco Cyber Vision	Version 3.0.5
Cisco Cyber Vision	Version 3.0.6
Cisco Cyber Vision	Version 3.1.0
Cisco Cyber Vision	Version 3.1.1
Cisco Cyber Vision	Version 3.1.2
Cisco Cyber Vision	Version 3.2.0
Cisco Cyber Vision	Version 3.2.1
Cisco Cyber Vision	Version 3.2.2
Cisco Cyber Vision	Version 3.2.3
Cisco Cyber Vision	Version 3.2.4
Cisco Cyber Vision	Version 4.0.0
Cisco Cyber Vision	Version 4.0.1
Cisco Cyber Vision	Version 4.0.2
Cisco Cyber Vision	Version 4.0.3
Cisco Cyber Vision	Version 4.1.0
Cisco Cyber Vision	Version 4.1.1
Cisco Cyber Vision	Version 4.1.2
Cisco Cyber Vision	Version 4.1.3
Cisco Cyber Vision	Version 4.1.4
Cisco Cyber Vision	Version 4.1.5
Cisco Cyber Vision	Version 4.1.6
Cisco Cyber Vision	Version 4.1.7
Cisco Cyber Vision	Version 4.2.0
Cisco Cyber Vision	Version 4.2.1
Cisco Cyber Vision	Version 4.2.2
Cisco Cyber Vision	Version 4.2.3
Cisco Cyber Vision	Version 4.2.4
Cisco Cyber Vision	Version 4.2.6
Cisco Cyber Vision	Version 4.3.0
Cisco Cyber Vision	Version 4.3.1
Cisco Cyber Vision	Version 4.3.2
Cisco Cyber Vision	Version 4.3.3
Cisco Cyber Vision	Version 4.4.0
Cisco Cyber Vision	Version 4.4.1
Cisco Cyber Vision	Version 4.4.2
Cisco Cyber Vision	Version 4.4.3
Cisco Cyber Vision	Version 5.0.0
Cisco Cyber Vision	Version 5.0.1
Cisco Cyber Vision	Version 5.0.2
Cisco Cyber Vision	Version 5.1.0
Cisco Cyber Vision	Version 5.1.1
Cisco Cyber Vision	Version 5.1.2
Cisco Cyber Vision	Version 5.1.3
Cisco Cyber Vision	Version 5.2.0
Cisco Cyber Vision	Version 5.2.1
Cisco Cyber Vision	Version 5.3.0
Cisco Cyber Vision	Version 5.3.1
Cisco Cyber Vision	Version 5.3.2

Configuration C

37 vulnerable

Vulnerable Software	Affected Versions
Cisco Secure Firewall Threat Defense	Version 7.2.0.1
Cisco Secure Firewall Threat Defense	Version 7.2.0
Cisco Secure Firewall Threat Defense	Version 7.2.10.2
Cisco Secure Firewall Threat Defense	Version 7.2.10
Cisco Secure Firewall Threat Defense	Version 7.2.1
Cisco Secure Firewall Threat Defense	Version 7.2.2
Cisco Secure Firewall Threat Defense	Version 7.2.3
Cisco Secure Firewall Threat Defense	Version 7.2.4.1
Cisco Secure Firewall Threat Defense	Version 7.2.4
Cisco Secure Firewall Threat Defense	Version 7.2.5.1
Cisco Secure Firewall Threat Defense	Version 7.2.5.2
Cisco Secure Firewall Threat Defense	Version 7.2.5
Cisco Secure Firewall Threat Defense	Version 7.2.6
Cisco Secure Firewall Threat Defense	Version 7.2.7
Cisco Secure Firewall Threat Defense	Version 7.2.8.1
Cisco Secure Firewall Threat Defense	Version 7.2.8
Cisco Secure Firewall Threat Defense	Version 7.2.9
Cisco Secure Firewall Threat Defense	Version 7.3.0
Cisco Secure Firewall Threat Defense	Version 7.3.1.1
Cisco Secure Firewall Threat Defense	Version 7.3.1.2
Cisco Secure Firewall Threat Defense	Version 7.3.1
Cisco Secure Firewall Threat Defense	Version 7.4.0
Cisco Secure Firewall Threat Defense	Version 7.4.1.1
Cisco Secure Firewall Threat Defense	Version 7.4.1
Cisco Secure Firewall Threat Defense	Version 7.4.2.1
Cisco Secure Firewall Threat Defense	Version 7.4.2.2
Cisco Secure Firewall Threat Defense	Version 7.4.2.3
Cisco Secure Firewall Threat Defense	Version 7.4.2.4
Cisco Secure Firewall Threat Defense	Version 7.4.2
Cisco Secure Firewall Threat Defense	Version 7.4.3
Cisco Secure Firewall Threat Defense	Version 7.6.0
Cisco Secure Firewall Threat Defense	Version 7.6.1
Cisco Secure Firewall Threat Defense	Version 7.6.2.1
Cisco Secure Firewall Threat Defense	Version 7.6.2
Cisco Secure Firewall Threat Defense	Version 7.7.0
Cisco Secure Firewall Threat Defense	Version 7.7.10.1
Cisco Secure Firewall Threat Defense	Version 7.7.10

Configuration D

103 vulnerable

Vulnerable Software	Affected Versions
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.7
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.12.8
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.10
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.1
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.7a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 16.6.9
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.1.1
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.10.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.11.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.3a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.4a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.4b
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.5a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.5b
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.5c
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.5d
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.12.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.13.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.14.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.2a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.2c
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.3a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.15.4c
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.16.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.17.1
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.18.1
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.18.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.18.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.2.1r
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.4a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.7
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.8
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.3.8a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.4.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.4.1b
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.4.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.5.1
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.5.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.3a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.6a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.7
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.8
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.6.8a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.7.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.7.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.8.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.1a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.2a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.3a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.4a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.5a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.5e
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.5f
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.7a
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.7b
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 17.9.8
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 3.17.0s
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version 3.17.1s
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version denali-16.3.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version denali-16.3.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version denali-16.3.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version denali-16.3.7
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version denali-16.3.9
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version everest-16.6.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version everest-16.6.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version everest-16.6.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.2
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.3
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.4
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.5
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.6
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.7
Cisco Unified Threat Defense Snort Intrusion Prevention System Engine	Version fuji-16.9.8

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (1)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed

Source: psirt@cisco.com

Vendor AdvisoryMitigation

Timeline

No history available yet.