The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec…
Priority MEDIUM 54CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression.
Why it matters now
EPSS 0.17739 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:symantec:norton_security:*:*:*:*:*:macos:*:* | up to 13.0.1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:protection_engine:*:*:*:*:*:*:*:* | 7.0.0 – 7.0.5; 7.5.0 – 7.5.4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:protection_engine:7.8.0:*:*:*:*:*:*:* | 7.8.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:advanced_threat_protection:*:*:*:*:*:*:*:* | up to 2.0.3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_bootable_removal_tool:*:*:*:*:*:*:*:* | up to 2016.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:data_center_security_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:data_center_security_server:6.0:mp1:*:*:*:*:*:* | 6.0 mp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:data_center_security_server:6.5:*:*:*:*:*:*:* | 6.5 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:data_center_security_server:6.5:mp1:*:*:*:*:*:* | 6.5 mp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:data_center_security_server:6.6:*:*:*:*:*:*:* | 6.6 | Vulnerable | Symantec |
- cpe:2.3:a:symantec:norton_security:*:*:*:*:*:macos:*:* Versions up to 13.0.1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:protection_engine:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.0.5; 7.5.0 – 7.5.4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:protection_engine:7.8.0:*:*:*:*:*:*:* Versions 7.8.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:advanced_threat_protection:*:*:*:*:*:*:*:* Versions up to 2.0.3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_bootable_removal_tool:*:*:*:*:*:*:*:* Versions up to 2016.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:data_center_security_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:data_center_security_server:6.0:mp1:*:*:*:*:*:* Versions 6.0 mp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:data_center_security_server:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·Symantec
- cpe:2.3:a:symantec:data_center_security_server:6.5:mp1:*:*:*:*:*:* Versions 6.5 mp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:data_center_security_server:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·Symantec
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:symantec:data_center_security_server:6.6:mp1:*:*:*:*:*:* | 6.6 mp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:protection_for_sharepoint_servers:*:*:*:*:*:*:*:* | 6.0 – 6.0.6; 6.03 – 6.05 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:message_gateway_for_service_providers:10.5:*:*:*:*:*:*:* | 10.5 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:message_gateway_for_service_providers:10.6:*:*:*:*:*:*:* | 10.6 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:csapi:*:*:*:*:*:*:*:* | up to 10.0.4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:*:*:*:*:*:*:* | 12.1.6 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp1:*:*:*:*:*:* | 12.1.6 mp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp2:*:*:*:*:*:* | 12.1.6 mp2 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp3:*:*:*:*:*:* | 12.1.6 mp3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:*:*:* | 12.1.6 mp4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:linux:*:* | 12.1.6 mp4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:macos:*:* | 12.1.6 mp4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_power_eraser:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:mail_security_for_domino:*:*:*:*:*:*:*:* | 8.0 – 8.0.9; 8.1 – 8.1.3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:*:*:*:*:*:*:*:* | 7.0 – 7.0.4; 7.5 – 7.5.4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:6.5.8:*:*:*:*:*:*:* | 6.5.8 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:message_gateway:*:*:*:*:*:*:*:* | up to 10.6.1-3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_360:*:*:*:*:*:*:*:* | all versions | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:* | all versions | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_internet_security:*:*:*:*:*:*:*:* | all versions | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_security:*:*:*:*:*:*:*:* | all versions | Vulnerable | Symantec |
| cpe:2.3:a:symantec:norton_security_with_backup:*:*:*:*:*:*:*:* | all versions | Vulnerable | Symantec |
| cpe:2.3:a:symantec:ngc:*:*:*:*:*:*:*:* | up to 22.6 | Vulnerable | Symantec |
- cpe:2.3:a:symantec:data_center_security_server:6.6:mp1:*:*:*:*:*:* Versions 6.6 mp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:protection_for_sharepoint_servers:*:*:*:*:*:*:*:* Versions 6.0 – 6.0.6; 6.03 – 6.05 Vulnerable ·Symantec
- cpe:2.3:a:symantec:message_gateway_for_service_providers:10.5:*:*:*:*:*:*:* Versions 10.5 Vulnerable ·Symantec
- cpe:2.3:a:symantec:message_gateway_for_service_providers:10.6:*:*:*:*:*:*:* Versions 10.6 Vulnerable ·Symantec
- cpe:2.3:a:symantec:csapi:*:*:*:*:*:*:*:* Versions up to 10.0.4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:*:*:*:*:*:*:* Versions 12.1.6 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp1:*:*:*:*:*:* Versions 12.1.6 mp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp2:*:*:*:*:*:* Versions 12.1.6 mp2 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp3:*:*:*:*:*:* Versions 12.1.6 mp3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:*:*:* Versions 12.1.6 mp4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:linux:*:* Versions 12.1.6 mp4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:endpoint_protection:12.1.6:mp4:*:*:*:macos:*:* Versions 12.1.6 mp4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_power_eraser:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:mail_security_for_domino:*:*:*:*:*:*:*:* Versions 8.0 – 8.0.9; 8.1 – 8.1.3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:*:*:*:*:*:*:*:* Versions 7.0 – 7.0.4; 7.5 – 7.5.4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:mail_security_for_microsoft_exchange:6.5.8:*:*:*:*:*:*:* Versions 6.5.8 Vulnerable ·Symantec
- cpe:2.3:a:symantec:message_gateway:*:*:*:*:*:*:*:* Versions up to 10.6.1-3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_360:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_internet_security:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_security:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Symantec
- cpe:2.3:a:symantec:norton_security_with_backup:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Symantec
- cpe:2.3:a:symantec:ngc:*:*:*:*:*:*:*:* Versions up to 22.6 Vulnerable ·Symantec
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3646
- 2026-10-03 Alias added: GHSA-98c6-gm3f-97p3
References
More Symantec Advanced Threat Protection vulnerabilities
- TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
- TI-2016-03091 Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec… CVSS 3.0CRITICAL 9.8
- TI-2016-03090 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 8.4
- TI-2016-02016 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 8.4
- TI-2016-02018 Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced… CVSS 3.0HIGH 7.3
- TI-2016-02019 Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced… CVSS 3.0HIGH 7.3
Sources
- CVE-2016-3646 · CVE Program
- CVE-2016-3646 · NVD
- FIRST EPSS
- GHSA-98c6-gm3f-97p3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences