ZDI-26-867: Cisco Snort sf_unfold_header Out-Of-Bounds Write Remote Code Execution Vulnerability
Published Nov 3, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-20043.
Event History
Nov 3, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Does exploitation require authentication?
No. The vulnerability can be exploited remotely without authentication.
2
What is the potential impact of successful exploitation?
A remote attacker could execute arbitrary code on an affected Cisco Snort installation.
3
Which CVE identifies this issue?
This issue is assigned CVE-2026-20043.