The vulnerability stems from improper error handling when decompressing VBA data in Snort 3. An attacker can send specially crafted VBA data to the Snort 3 Detection Engine, which will process the data without adequate bounds checking, leading to a crash. The crash causes the Snort 3 engine to restart, resulting in a denial‑of‑service to the firewall’s intrusion detection capabilities. The flaw is classified as CWE‑786 and allows only a denial of service, with no privilege escalation.

Cisco Secure Firewall Threat Defense Software (FTD) and Cisco UTD SNORT IPS Engine Software are vulnerable. No specific firmware or software version ranges are listed in the advisory; administrators should check for updates on affected deployments.

The CVSS score of 5.8 indicates moderate severity. EPSS shows a likelihood of exploitation of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an unauthenticated remote attacker can exploit it by sending a crafted VBA payload over a network path that reaches the Snort 3 engine, typically through the firewall’s management or data plane. Successful exploitation results in a restart of the detection engine, interrupting packet inspection for the affected device. The condition does not require authenticated access or privileged execution, but requires the ability to reach the Snort 3 service.