Description

Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-14T07:17:16.267Z",
  "pubdate": "2026-09-14T07:17:16.267Z",
  "executiveSummary": "The WithSecure Atlant security suite, specifically when utilizing the Capricorn engine, contains an out-of-bounds (OOB) memory read vulnerability prior to the 2025-01-20_02 build.\nThis vulnerability is classified as an out-of-bounds memory access flaw occurring during the file parsing stage of the antivirus engine.\nAn unauthenticated, remote attacker can trigger this condition by supplying a specially crafted document file to the system.\nSuccessful exploitation results in a Remote Denial of Service (RDoS), causing the antivirus engine to crash or become unresponsive, thereby disabling security monitoring capabilities for the affected system.\nThe vulnerability poses significant risk to system integrity and threat detection efficacy by allowing attackers to neutralize the protective layer of the Atlant platform.\nExploitation does not require prior authentication or elevated privileges, provided the attacker can force the antivirus engine to process the malicious payload.",
  "technicalDetails": "The vulnerability originates within the file processing logic of the Capricorn engine, the core component responsible for deep inspection and heuristic analysis of file formats in WithSecure Atlant.\nThe root cause is an improper bounds check during the parsing of document file structures. When the engine encounters a malformed document with specifically manipulated headers or internal object offsets, the code fails to validate the size of the data being read against the allocated memory buffer.\nThe OOB memory read occurs when the parser attempts to access memory outside of the designated heap or stack buffer bounds, leading to an illegal memory access exception.\nThe attack flow begins when the adversary delivers a malicious document to an environment monitored by WithSecure Atlant. This delivery can occur through various vectors, such as email attachments, downloads, or network shares indexed by the software. Upon receipt or scan-time execution, the Capricorn engine initiates the file parsing procedure to analyze the document's content for threats.\nAs the parser processes the weaponized segments of the document, it performs an out-of-bounds read, which forces the host process responsible for the scan—often running with elevated system or service-level privileges—to trigger an unhandled exception.\nBecause the engine is a critical component of the security architecture, the resulting crash interrupts the scanning daemon, causing a service failure. This renders the system temporarily vulnerable to secondary threats, as the antivirus engine is no longer inspecting incoming traffic or file operations while in a crashed state.\nThe flaw affects all versions of the Capricorn engine integrated within WithSecure Atlant that predate the 2025-01-20_02 update. As this is a memory access issue occurring at the engine level, it effectively circumvents standard security posture protections once the malformed file is ingested by the scanner.\nPost-exploitation impact is focused primarily on the availability of the security product; however, depending on the memory layout and system protections (like ASLR or DEP), OOB read vulnerabilities of this nature can sometimes be leveraged to leak sensitive memory addresses to assist in further, more complex exploit chains, though the primary observed impact remains the Denial of Service condition."
}