Read the docs
TI-2018-12984 Aliases CVE-2018-18366GHSA-6mpj-9376-4g2w

Use of uninitialized resource in Symantec Norton Security

Priority LOW 29CWE-908Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory.

Why it matters now

EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed Norton Security (Symantec Corporation): 22.16.3SEP Cloud (Symantec Corporation): 22.16.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Securitybefore 22.16.322.16.3Patch availableCNA
SymantecSEP (Windows client)Prior to and including 12.1 RU6 MP9; Prior to 14.2 RU1—No fix listedCNA
SymantecSEP SBEPrior to Cloud Agent 3.00.31.2817; NIS-22.15.2.22; SEP-12.1.7484.7002—No fix listedCNA
SymantecSEP Cloudbefore 22.16.322.16.3Patch availableCNA
  • Norton Security VendorSymantec Affected before 22.16.3 Fixed in 22.16.3 Patch available CNA
  • SEP (Windows client) VendorSymantec Affected Prior to and including 12.1 RU6 MP9; Prior to 14.2 RU1 Fixed in — No fix listed CNA
  • SEP SBE VendorSymantec Affected Prior to Cloud Agent 3.00.31.2817; NIS-22.15.2.22; SEP-12.1.7484.7002 Fixed in — No fix listed CNA
  • SEP Cloud VendorSymantec Affected before 22.16.3 Fixed in 22.16.3 Patch available CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:windows:*:*11.0VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr1:*:*:*:windows:*:*11.0 mr1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr2:*:*:*:windows:*:*11.0 mr2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr3:*:*:*:windows:*:*11.0 mr3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr4:*:*:*:windows:*:*11.0 mr4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp2:*:*:*:windows:*:*11.0 mr4-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru5:*:*:*:windows:*:*11.0 ru5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6:*:*:*:windows:*:*11.0 ru6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp1:*:*:*:windows:*:*11.0 ru6-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp2:*:*:*:windows:*:*11.0 ru6-mp2VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:windows:*:* Versions 11.0 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr1:*:*:*:windows:*:* Versions 11.0 mr1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr2:*:*:*:windows:*:* Versions 11.0 mr2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr3:*:*:*:windows:*:* Versions 11.0 mr3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr4:*:*:*:windows:*:* Versions 11.0 mr4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:mr4-mp2:*:*:*:windows:*:* Versions 11.0 mr4-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru5:*:*:*:windows:*:* Versions 11.0 ru5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6:*:*:*:windows:*:* Versions 11.0 ru6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp1:*:*:*:windows:*:* Versions 11.0 ru6-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp2:*:*:*:windows:*:* Versions 11.0 ru6-mp2 Vulnerable ·Symantec
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp3:*:*:*:windows:*:*11.0 ru6-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru6a:*:*:*:windows:*:*11.0 ru6aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7:*:*:*:windows:*:*11.0 ru7VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp1:*:*:*:windows:*:*11.0 ru7-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp2:*:*:*:windows:*:*11.0 ru7-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4:*:*:*:windows:*:*11.0 ru7-mp4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4a:*:*:*:windows:*:*11.0 ru7-mp4aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:11.0:ry7-mp3:*:*:*:windows:*:*11.0 ry7-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:*:*:*:*:windows:*:*12.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru1:*:*:*:windows:*:*12.1 ru1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru1-mp1:*:*:*:windows:*:*12.1 ru1-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru2:*:*:*:windows:*:*12.1 ru2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru2-mp1:*:*:*:windows:*:*12.1 ru2-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru3:*:*:*:windows:*:*12.1 ru3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4:*:*:*:windows:*:*12.1 ru4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1:*:*:*:windows:*:*12.1 ru4-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1a:*:*:*:windows:*:*12.1 ru4-mp1aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1b:*:*:*:windows:*:*12.1 ru4-mp1bVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru4a:*:*:*:windows:*:*12.1 ru4aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru5:*:*:*:windows:*:*12.1 ru5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6:*:*:*:windows:*:*12.1 ru6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp1:*:*:*:windows:*:*12.1 ru6-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp10:*:*:*:windows:*:*12.1 ru6-mp10VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp2:*:*:*:windows:*:*12.1 ru6-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp3:*:*:*:windows:*:*12.1 ru6-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp4:*:*:*:windows:*:*12.1 ru6-mp4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp5:*:*:*:windows:*:*12.1 ru6-mp5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp6:*:*:*:windows:*:*12.1 ru6-mp6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp7:*:*:*:windows:*:*12.1 ru6-mp7VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp8:*:*:*:windows:*:*12.1 ru6-mp8VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14:*:*:*:*:windows:*:*14VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14:mp1:*:*:*:windows:*:*14 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp2:*:*:*:windows:*:*14.0.0 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:*:*:*:*:windows:*:*14.0.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp1:*:*:*:windows:*:*14.0.1 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp2:*:*:*:windows:*:*14.0.1 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.2:*:*:*:*:windows:*:*14.2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:14.2:mp1:*:*:*:windows:*:*14.2 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:nis-22.15.2.22:*:*:*:small_business:*:*:*nis-22.15.2.22VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection:sep-12.1.7484.7002:*:*:*:small_business:*:*:*sep-12.1.7484.7002VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:*before 22.16.3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_cloud_agent:*:*:*:*:small_business:*:*:*before 3.00.31.2817VulnerableSymantec
cpe:2.3:a:symantec:norton_security:*:*:*:*:*:windows:*:*before 22.16.3VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6-mp3:*:*:*:windows:*:* Versions 11.0 ru6-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru6a:*:*:*:windows:*:* Versions 11.0 ru6a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7:*:*:*:windows:*:* Versions 11.0 ru7 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp1:*:*:*:windows:*:* Versions 11.0 ru7-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp2:*:*:*:windows:*:* Versions 11.0 ru7-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4:*:*:*:windows:*:* Versions 11.0 ru7-mp4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ru7-mp4a:*:*:*:windows:*:* Versions 11.0 ru7-mp4a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:11.0:ry7-mp3:*:*:*:windows:*:* Versions 11.0 ry7-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:*:*:*:*:windows:*:* Versions 12.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru1:*:*:*:windows:*:* Versions 12.1 ru1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru1-mp1:*:*:*:windows:*:* Versions 12.1 ru1-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru2:*:*:*:windows:*:* Versions 12.1 ru2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru2-mp1:*:*:*:windows:*:* Versions 12.1 ru2-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru3:*:*:*:windows:*:* Versions 12.1 ru3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4:*:*:*:windows:*:* Versions 12.1 ru4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1:*:*:*:windows:*:* Versions 12.1 ru4-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1a:*:*:*:windows:*:* Versions 12.1 ru4-mp1a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4-mp1b:*:*:*:windows:*:* Versions 12.1 ru4-mp1b Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru4a:*:*:*:windows:*:* Versions 12.1 ru4a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru5:*:*:*:windows:*:* Versions 12.1 ru5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6:*:*:*:windows:*:* Versions 12.1 ru6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp1:*:*:*:windows:*:* Versions 12.1 ru6-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp10:*:*:*:windows:*:* Versions 12.1 ru6-mp10 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp2:*:*:*:windows:*:* Versions 12.1 ru6-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp3:*:*:*:windows:*:* Versions 12.1 ru6-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp4:*:*:*:windows:*:* Versions 12.1 ru6-mp4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp5:*:*:*:windows:*:* Versions 12.1 ru6-mp5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp6:*:*:*:windows:*:* Versions 12.1 ru6-mp6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp7:*:*:*:windows:*:* Versions 12.1 ru6-mp7 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:12.1:ru6-mp8:*:*:*:windows:*:* Versions 12.1 ru6-mp8 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14:*:*:*:*:windows:*:* Versions 14 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14:mp1:*:*:*:windows:*:* Versions 14 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.0:mp2:*:*:*:windows:*:* Versions 14.0.0 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:*:*:*:*:windows:*:* Versions 14.0.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp1:*:*:*:windows:*:* Versions 14.0.1 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.0.1:mp2:*:*:*:windows:*:* Versions 14.0.1 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.2:*:*:*:*:windows:*:* Versions 14.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:14.2:mp1:*:*:*:windows:*:* Versions 14.2 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:nis-22.15.2.22:*:*:*:small_business:*:*:* Versions nis-22.15.2.22 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection:sep-12.1.7484.7002:*:*:*:small_business:*:*:* Versions sep-12.1.7484.7002 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:* Versions before 22.16.3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_cloud_agent:*:*:*:*:small_business:*:*:* Versions before 3.00.31.2817 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_security:*:*:*:*:*:windows:*:* Versions before 22.16.3 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Security (Symantec Corporation) Fixed in 22.16.3
  • Fix · CNA SEP Cloud (Symantec Corporation) Fixed in 22.16.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-18366
  2. 2026-10-03 Alias added: GHSA-6mpj-9376-4g2w

References

Advisory 1

  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2009-01354 Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in… CVSS 2.0HIGH 9.3
  • TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
  • TI-2012-01284 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences