A stack-based buffer overflow exists in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine. The flaw arises from improper range checking when processing user‑controlled VBA data, which can be crafted by an unauthenticated attacker to overwrite stack memory. If successfully exploited the attack can force the Snort 3 Detection Engine to crash or restart, leading to an outage of the intrusion detection capability and effectively denying service to legitimate users.

The vulnerability affects Cisco products that include the Snort 3 VBA engine: Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. Specific product versions are not disclosed in the available data, so all deployments of these products that incorporate the VBA Decompression Engine are potentially exposed.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score is not available, meaning the current likelihood of exploitation is unclear. The vulnerability is listed as not being in the CISA KEV catalog. A remote attacker could trigger the exploit by sending malicious VBA payloads over the network to a targeted device, leveraging the vulnerability in the decompression routine to cause a stack overflow and a subsequent denial of service.