Description

Tanium addressed a compression bomb vulnerability in Threat Response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T21:17:37.143Z",
  "pubdate": "2026-08-19T21:17:37.143Z",
  "executiveSummary": "A compression bomb vulnerability has been identified and addressed in Tanium Threat Response. This flaw involves improper handling of compressed data archives, allowing malicious actors to supply specially crafted inputs designed to expand exponentially when processed by the affected product.\nThe primary impact of this vulnerability is resource exhaustion, specifically targeting system memory and central processing unit utilization, which can lead to a denial of service condition for the vulnerable component. The affected system is Tanium Threat Response, which processes forensic data and compressed payloads during standard operational workflows.\nRisk implications include potential disruption of security monitoring and incident response capabilities if the underlying infrastructure becomes unresponsive due to resource starvation.\nAttacker capabilities involve the ability to craft and submit malicious compressed payloads to the target system. Exploitation requirements typically necessitate an attacker having a mechanism to deliver the oversized payload to the parsing engine of Tanium Threat Response, leading to excessive resource allocation during the decompression phase.\nOrganizations utilizing the affected software must apply vendor-supplied updates and adhere to hardening guidelines to prevent denial of service vectors associated with archive processing.",
  "technicalDetails": "The root cause of the vulnerability lies within the data ingestion and processing logic of Tanium Threat Response, specifically in the routines responsible for handling compressed archives. When parsing untrusted input, the application fails to enforce strict resource boundaries, such as maximum decompression size limits, recursion depth checks, or memory allocation thresholds.\nExploitation occurs when an attacker submits a highly compressed payload—often referred to as a zip bomb or compression bomb—to the vulnerable component. A compression bomb typically consists of a tiny file size on disk that expands exponentially when decompressed, sometimes growing from a few kilobytes to gigabytes of uncompressed data.\nThe attack flow proceeds as follows: First, the malicious payload is delivered to the Tanium Threat Response parsing engine, either through automated ingestion pipelines or direct user interaction vectors depending on the architecture. Second, the vulnerable component initiates the decompression process without validating the final uncompressed size against predefined safety quotas. Third, as the archive expands in memory or temporary storage, system resources are rapidly depleted.\nThe vulnerable component is the archive processing and decompression subsystem within Tanium Threat Response across unspecified affected versions. Network exposure and authentication requirements depend on the specific ingestion vector utilized by the application, but successful exploitation generally results in immediate operational degradation or complete unresponsiveness of the affected service.\nPost-exploitation impact is primarily focused on availability, manifesting as a denial of service condition. By exhausting host memory and CPU cycles, the vulnerability prevents Tanium Threat Response from executing critical threat detection, forensic data collection, and incident response tasks, thereby temporarily blinding security operations relying on the platform."
}