CVE-2022-27534 Memory corruption in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security
A bug in the data parsing module allows attackers to execute arbitrary code on Kaspersky antivirus products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27534?
CVE-2022-27534 is a critical memory corruption vulnerability in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
Which versions are affected by CVE-2022-27534?
It affects 6 products.
Products include Kaspersky Anti-Virus, Kaspersky Endpoint Security, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Small Office Security, Kaspersky Total Security.
How do I fix CVE-2022-27534?
No fix has been published for CVE-2022-27534 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-27534 being exploited?
There is no known exploitation of CVE-2022-27534 in the wild and no public exploit code.
Other vulnerabilities in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security
- CVE-2019-15687 Information disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud
- CVE-2019-15688 Open redirect in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud
- CVE-2021-27223 Denial of service in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security
- CVE-2016-4329 Denial of service in Total Security
- CVE-2019-15685 Security feature bypass in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud
Sources
Also known as GHSA-3jp7-w7p7-xq57.