Multiple interpretation error in Ukrainian National Antivirus (UNA) 1.83.2.16 with kernel 265 allows remote attackers to bypass virus…

Description

Multiple interpretation error in Ukrainian National Antivirus (UNA) 1.83.2.16 with kernel 265 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."

Scores

EPSS (exploitation in 30 days)

2.1% · top 18% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (5)

• 15189 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://www.securityelf.org/magicbyte.html (opens in a new tab)x_refsource_MISCx_transferred
• http://www.securityelf.org/magicbyteadv.html (opens in a new tab)x_refsource_MISCx_transferred
• 20051025 Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• http://www.securityelf.org/updmagic.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2005-3381](https://trackcve.app/badge/CVE-2005-3381.svg)](https://trackcve.app/cve/CVE-2005-3381)

Record last updated 7 Aug 2024, 23:10 UTC.