Vulnerability Spotlight: Vulnerabilities in Alyac antivirus program could stop virus scanning, cause code execution
Summary: Cisco Talos discovered out-of-bounds read and buffer overflow vulnerabilities in ESTsecurity Corp.'s Alyac antivirus software for Windows that could cause a denial-of-service condition or arbitrary code execution. TALOS-2022-1452 (CVE-2022-21147) crashes Alyac's scanning process, while TALOS-2022-1527 (CVE-2022-32543) and TALOS-2022-1533 (CVE-2022-29886) are heap-based buffer overflows triggered when a user opens a specially crafted OLE file.
What's compelling: One of these flaws stops the antivirus scan outright, which an attacker would find crucial in a potential attack scenario, and the affected versions are ESTsoft Alyac 2.5.7.7 and 2.5.8.544.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-21147CVE-2022-29886CVE-2022-32543
- Related
- Vulnerability Spotlight: Vulnerability in Alyac antivirus program could stop virus scanning, cause denial of service Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026