Read the docs
TI-2024-00193 Aliases CVE-2024-0213GHSA-qmfw-q6m7-ff6j

Buffer overflow in Trellix Agent

Priority LOW 35CWE-120Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed Trellix Agent (TA) (Trellix): 5.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrellixTrellix Agent (TA)before 5.8.15.8.1Patch availableCNA
  • Trellix Agent (TA) VendorTrellix Affected before 5.8.1 Fixed in 5.8.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:trellix:agent:*:*:*:*:linux:*:*:*before 5.8.1VulnerableTrellix
cpe:2.3:a:trellix:agent:*:*:*:*:macos:*:*:*before 5.8.1VulnerableTrellix
  • cpe:2.3:a:trellix:agent:*:*:*:*:linux:*:*:* Versions before 5.8.1 Vulnerable ·Trellix
  • cpe:2.3:a:trellix:agent:*:*:*:*:macos:*:*:* Versions before 5.8.1 Vulnerable ·Trellix

Remediation

  • Fix · CNA Trellix Agent (TA) (Trellix) Fixed in 5.8.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0213
  2. 2026-10-03 Alias added: GHSA-qmfw-q6m7-ff6j

References

Patch 1

  • TI-2023-00925 A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that… CVSS 3.1HIGH 8.2
  • TI-2023-01312 Out-of-bounds write in Trellix Agent CVSS 3.1HIGH 8.1
  • TI-2023-00926 Uncontrolled search path in Trellix Agent CVSS 3.1HIGH 7.8
  • TI-2023-00927 Buffer overflow in Trellix Agent CVSS 3.1MEDIUM 6.7
  • TI-2022-03537 Uncontrolled search path in Trellix Agent CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences