CVE-2025-26790 Overview
CVE-2025-26790 affects WithSecure Atlant deployments using the Capricorn antivirus engine before update 2025-01-20_02. The vulnerability is an out-of-bounds memory read [CWE-125] triggered when the engine processes a crafted document file. A remote attacker can submit a malicious document that causes the scanning engine to read memory outside allocated bounds, resulting in a denial of service against the antivirus scanning process.
Critical Impact
A remote, unauthenticated attacker can disrupt antivirus scanning by submitting a crafted document to the Capricorn engine, degrading availability of the protection layer.
Affected Products
- WithSecure Atlant using the Capricorn engine before 2025-01-20_02
- Deployments processing untrusted document files through the Capricorn scanning engine
- Environments exposing Atlant scanning services to network-delivered content
Discovery Timeline
- 2026-09-14 - CVE-2025-26790 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2025-26790
Vulnerability Analysis
The flaw resides in the Capricorn antivirus engine bundled with WithSecure Atlant. When the engine parses a specially crafted document file, it performs a read operation past the boundaries of an allocated buffer. This out-of-bounds read [CWE-125] causes the scanning process to terminate or become unresponsive, producing a denial of service condition.
Because the vulnerable code path lies inside the antivirus engine itself, the attacker does not require authentication or user interaction. Any pipeline that submits network-delivered documents to Atlant for scanning becomes a viable delivery channel. Exploitation complexity is high, which limits opportunistic abuse but does not prevent targeted disruption.
The impact is confined to availability. The advisory does not describe memory disclosure or code execution, and the CWE classification aligns with a bounded read outside intended memory rather than a corruption primitive.
Root Cause
The root cause is insufficient bounds validation during document parsing inside the Capricorn engine. Malformed structures in the input document cause the parser to reference memory beyond the allocated region, triggering a fault in the scanning process. WithSecure addressed the issue in engine build 2025-01-20_02.
Attack Vector
Exploitation is remote and requires no privileges or user interaction. An attacker delivers a crafted document to any workflow that submits files to the Atlant scanning service, such as mail gateways, file upload endpoints, or content inspection pipelines. Processing the document by the Capricorn engine triggers the fault. Refer to the WithSecure Security Advisory CVE-2025-26790 for vendor technical details.
Detection Methods for CVE-2025-26790
Indicators of Compromise
- Unexpected crashes, restarts, or hangs of the Capricorn scanning engine process on Atlant hosts
- Scanning queue backlogs or repeated timeouts correlated with specific inbound document files
- Engine error logs referencing memory access faults during document parsing
Detection Strategies
- Monitor Atlant engine logs for abnormal termination events tied to document scanning operations
- Correlate scanning failures with the source of the submitted file to identify repeat malicious senders
- Track engine version and definition build across the fleet to identify hosts still running builds prior to 2025-01-20_02
Monitoring Recommendations
- Alert on repeated Capricorn engine restarts within a short time window
- Track scanning throughput and queue depth to detect availability degradation
- Capture quarantined or failed samples for offline analysis to identify crafted document structures
How to Mitigate CVE-2025-26790
Immediate Actions Required
- Update the Capricorn engine on all WithSecure Atlant deployments to build 2025-01-20_02 or later
- Verify that automatic engine updates are enabled and reaching all Atlant nodes
- Review recent scanning failures to identify whether crafted documents have already been submitted
Patch Information
WithSecure released a fixed Capricorn engine build 2025-01-20_02 that resolves the out-of-bounds read. Consult the WithSecure Security Advisory CVE-2025-26790 for the vendor's authoritative remediation guidance and update procedures.
Workarounds
- Restrict submission of untrusted documents to the Atlant scanning service where feasible until the engine is updated
- Apply upstream filtering at mail and web gateways to reduce exposure to unsolicited document files
- Configure scanning service supervision to automatically restart the engine on failure to reduce availability impact
# Verify Capricorn engine build meets or exceeds the fixed version
# Replace with the vendor-documented command for your Atlant deployment
wsatlant --version
wsatlant engine --show capricorn
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
