A vulnerability in Cisco's Snort 3 VBA Decompression Engine can be exploited by an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash or restart unexpectedly, leading to a denial of service. The flaw is caused by improper range checking when decompressing user-controlled VBA data, which allows an attacker to craft malicious VBA payloads that overflow stack data, a buffer overflow weakness categorized as CWE-121. When successfully exploited, the stack overflow forces the detection engine to restart, disrupting intrusion detection and interrupting legitimate services.

The vulnerability affects Cisco products that include the Snort 3 VBA engine: Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. Specific product versions are not disclosed in the available data, so all deployments of these products that incorporate the VBA Decompression Engine are potentially exposed.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score of less than 1% indicates a very low but non‑zero exploitation probability. The vulnerability is listed as not being in the CISA KEV catalog. A remote attacker could trigger the exploit by sending malicious VBA payloads over the network to a targeted device, leveraging the vulnerability in the decompression routine to cause a stack overflow and a subsequent denial of service.