The vulnerability stems from improper range checking during the decompression of user‑controlled VBA data in Snort 3. This flaw can lead to a heap overflow that crashes the Snort 3 Detection Engine, resulting in a Denial of Service that renders the engine unavailable until it is restarted. The weakness is classified as CWE‑122.

The flaw affects Cisco products that incorporate Snort 3’s VBA capability, including Cisco Cyber Vision, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific version numbers are published in the advisory, so organizations should verify whether their deployed firmware or software matches the impacted components described in the Cisco advisory.

The CVSS score of 5.8 indicates a medium severity, and the EPSS score of less than 1 % points to a low likelihood of exploitation in the wild. The vulnerability can be triggered by any remote party that can send crafted VBA data to the detection engine; no authentication is required. Because the defect exploits a heap overflow, a successful attack results only in a crash, not arbitrary code execution. The vulnerability is not listed in the CISA KEV catalog, further suggesting that widespread exploitation has not been observed.