{"id":"CVE-2026-20058","details":"Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.\r\n\r\nThese vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition.","modified":"2026-08-22T03:58:01.932338794Z","published":"2026-03-04T18:16:20.643Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.10.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.0:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.3.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.2.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.7.0:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.7.10.1:*:*:*:*:*:*:*","cpe:2.3:a:cisco:secure_firewall_threat_defense:7.7.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.2.0"},{"last_affected":"7.2.0"},{"introduced":"7.2.0.1"},{"last_affected":"7.2.0.1"},{"introduced":"7.2.1"},{"last_affected":"7.2.1"},{"introduced":"7.2.2"},{"last_affected":"7.2.2"},{"introduced":"7.2.3"},{"last_affected":"7.2.3"},{"introduced":"7.2.4"},{"last_affected":"7.2.4"},{"introduced":"7.2.4.1"},{"last_affected":"7.2.4.1"},{"introduced":"7.2.5"},{"last_affected":"7.2.5"},{"introduced":"7.2.5.1"},{"last_affected":"7.2.5.1"},{"introduced":"7.2.5.2"},{"last_affected":"7.2.5.2"},{"introduced":"7.2.6"},{"last_affected":"7.2.6"},{"introduced":"7.2.7"},{"last_affected":"7.2.7"},{"introduced":"7.2.8"},{"last_affected":"7.2.8"},{"introduced":"7.2.8.1"},{"last_affected":"7.2.8.1"},{"introduced":"7.2.9"},{"last_affected":"7.2.9"},{"introduced":"7.2.10"},{"last_affected":"7.2.10"},{"introduced":"7.2.10.2"},{"last_affected":"7.2.10.2"},{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"introduced":"7.3.1"},{"last_affected":"7.3.1"},{"introduced":"7.3.1.1"},{"last_affected":"7.3.1.1"},{"introduced":"7.3.1.2"},{"last_affected":"7.3.1.2"},{"introduced":"7.4.0"},{"last_affected":"7.4.0"},{"introduced":"7.4.1"},{"last_affected":"7.4.1"},{"introduced":"7.4.1.1"},{"last_affected":"7.4.1.1"},{"introduced":"7.4.2"},{"last_affected":"7.4.2"},{"introduced":"7.4.2.1"},{"last_affected":"7.4.2.1"},{"introduced":"7.4.2.2"},{"last_affected":"7.4.2.2"},{"introduced":"7.4.2.3"},{"last_affected":"7.4.2.3"},{"introduced":"7.4.2.4"},{"last_affected":"7.4.2.4"},{"introduced":"7.4.3"},{"last_affected":"7.4.3"},{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.6.1"},{"last_affected":"7.6.1"},{"introduced":"7.6.2"},{"last_affected":"7.6.2"},{"introduced":"7.6.2.1"},{"last_affected":"7.6.2.1"},{"introduced":"7.7.0"},{"last_affected":"7.7.0"},{"introduced":"7.7.10"},{"last_affected":"7.7.10"},{"introduced":"7.7.10.1"},{"last_affected":"7.7.10.1"}],"source":"CPE_STRING","vendor_product":"cisco:secure_firewall_threat_defense"},{"cpes":["cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.2:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.3a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.4b:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5b:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5c:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.5d:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.12.6:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.13.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.14.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.2a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.2c:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.3:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.3a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.4:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.15.4c:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.16.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.17.1:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.1:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.1a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.18.2:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.3a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.5a:*:*:*:*:*:*:*","cpe:2.3:o:cisco:unified_threat_defense_snort_intrusion_prevention_system_engine:17.9.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.9.3a"},{"last_affected":"17.9.3a"},{"introduced":"17.9.5a"},{"last_affected":"17.9.5a"},{"introduced":"17.9.6"},{"last_affected":"17.9.6"},{"introduced":"17.12.1a"},{"last_affected":"17.12.1a"},{"introduced":"17.12.2"},{"last_affected":"17.12.2"},{"introduced":"17.12.3"},{"last_affected":"17.12.3"},{"introduced":"17.12.3a"},{"last_affected":"17.12.3a"},{"introduced":"17.12.4"},{"last_affected":"17.12.4"},{"introduced":"17.12.4a"},{"last_affected":"17.12.4a"},{"introduced":"17.12.4b"},{"last_affected":"17.12.4b"},{"introduced":"17.12.5"},{"last_affected":"17.12.5"},{"introduced":"17.12.5a"},{"last_affected":"17.12.5a"},{"introduced":"17.12.5b"},{"last_affected":"17.12.5b"},{"introduced":"17.12.5c"},{"last_affected":"17.12.5c"},{"introduced":"17.12.5d"},{"last_affected":"17.12.5d"},{"introduced":"17.12.6"},{"last_affected":"17.12.6"},{"introduced":"17.13.1a"},{"last_affected":"17.13.1a"},{"introduced":"17.14.1a"},{"last_affected":"17.14.1a"},{"introduced":"17.15.1a"},{"last_affected":"17.15.1a"},{"introduced":"17.15.2a"},{"last_affected":"17.15.2a"},{"introduced":"17.15.2c"},{"last_affected":"17.15.2c"},{"introduced":"17.15.3"},{"last_affected":"17.15.3"},{"introduced":"17.15.3a"},{"last_affected":"17.15.3a"},{"introduced":"17.15.4"},{"last_affected":"17.15.4"},{"introduced":"17.15.4c"},{"last_affected":"17.15.4c"},{"introduced":"17.16.1a"},{"last_affected":"17.16.1a"},{"introduced":"17.17.1"},{"last_affected":"17.17.1"},{"introduced":"17.18.1"},{"last_affected":"17.18.1"},{"introduced":"17.18.1a"},{"last_affected":"17.18.1a"},{"introduced":"17.18.2"},{"last_affected":"17.18.2"}],"source":"CPE_STRING","vendor_product":"cisco:unified_threat_defense_snort_intrusion_prevention_system_engine"}]},"references":[{"type":"ADVISORY","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-snort3-vbavuls-96UcVVed"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/snort3/snort3","events":[{"introduced":"7ae50f4be245efd469dee2ce2855b6235b07aa42"},{"fixed":"4e69376284a392c7c5d34726f219409140a1e9f2"}],"database_specific":{"cpe":"cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.0.0-233"},{"fixed":"3.9.6.0"}],"source":"CPE_RANGE"}}],"versions":["3.9.5.0","3.9.3.0","3.9.2.0","3.9.1.0","3.9.0.0","3.8.1.0","3.7.4.0","3.7.3.0","3.7.2.0","3.7.1.0","3.7.0.0","3.6.3.0","3.6.2.0","3.6.1.0","3.6.0.0","3.5.2.0","3.5.1.0","3.5.0.0","3.4.0.0","3.3.7.0","3.3.5.0","3.3.4.0","3.3.3.0","3.3.2.0","3.3.1.0","3.3.0.0","3.2.2.0","3.2.1.0","3.1.84.0","3.1.83.0","3.1.82.0","3.1.81.0","3.1.79.0","3.1.78.0","3.1.77.0","3.1.76.0","3.1.75.0","3.1.74.0","3.1.73.0","3.1.72.0","3.1.71.0","3.1.70.0","3.1.69.0","3.1.67.0","3.1.66.0","3.1.65.0","3.1.64.0","3.1.63.0","3.1.62.0","3.1.61.0","3.1.60.0","3.1.59.0","3.1.58.0","3.1.57.0","3.1.56.0","3.1.55.0","3.1.53.0","3.1.52.0","3.1.51.0","3.1.50.0","3.1.49.0","3.1.48.0","3.1.47.0","3.1.45.0","3.1.43.0","3.1.42.0","3.1.41.0","3.1.40.0","3.1.39.0","3.1.38.0","3.1.37.0","3.1.36.0","3.1.35.0","3.1.34.0","3.1.33.0","3.1.32.0","3.1.31.0","3.1.30.0","3.1.29.0","3.1.28.0","3.1.27.0","3.1.26.0","3.1.25.0","3.1.24.0","3.1.23.0","3.1.22.0","3.1.21.0","3.1.20.0","3.1.19.0","3.1.18.0","3.1.17.0","3.1.16.0","3.1.15.0","3.1.14.0","3.1.13.0","3.1.12.0","3.1.11.0","3.1.10.0","3.1.9.0","3.1.8.0","3.1.7.0","3.1.6.0","3.1.5.0","3.1.4.0","3.1.3.0","3.1.2.0","3.1.1.0","3.1.0.0","3.0.3-6","3.0.3-5","3.0.3-4","3.0.3-3","3.0.3-2","3.0.3-1","3.0.2-6","3.0.2-5","3.0.2-4","3.0.2-3","3.0.2-2","3.0.2-1","3.0.1-5","3.0.1-4","3.0.1-3","3.0.1-2","3.0.1-1","3.0.0-270","3.0.0-269","3.0.0-268","3.0.0-267","3.0.0-266","3.0.0-265","3.0.0-264","3.0.0-263","3.0.0-262","3.0.0-261","3.0.0-260","3.0.0-259","3.0.0-258","3.0.0-257","3.0.0-256","3.0.0-255","3.0.0-254","3.0.0_253","3.0.0-253","3.0.0-252","3.0.0-251","3.0.0-250","3.0.0-249","BUILD_248","3.0.0-248","BUILD_247","3.0.0-247","3.0.0-246","3.0.0-245","3.0.0-244","BUILD_243","3.0.0-243","BUILD_242","3.0.0-242","BUILD_241","3.0.0-241","BUILD_240","3.0.0-240","BUILD_239","3.0.0-239","BUILD_233","3.0.0-233"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-20058.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"}]}