An attacker can trigger an infinite loop in the Snort 3 Detection Engine by sending specially crafted VBA data, which causes the engine to crash. This flaw stems from improper error checking during VBA data decompression and results in a denial‑of‑service condition on the affected device.

The vulnerable products include Cisco Cyber Vision, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific version numbers are listed, so all current releases are potentially affected until an official patch is applied.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is accessible to unauthenticated remote attackers, and it is not currently listed in the CISA KEV catalog. Due to the nature of the flaw—an infinite loop leading to resource exhaustion—an attacker who succeeds could render the Snort 3 engine unusable, thereby degrading IDS functionality and potentially impacting the overall security posture of the network.