CVE-2025-26790 WithSecure CVE debrief

Who should care

Defenders responsible for Withsecure Atlant deployments, particularly those using the Capricorn engine, should assess their exposure and prioritize verification and potential remediation efforts.

Why it matters

CVE-2025-26790 is a Remote Denial of Service vulnerability in Withsecure Atlant with the Capricorn engine before 2025-01-20_02. Defenders should verify exposure, assess remediation needs, and consider compensating controls. Evidence is limited, and further verification is required.

• Potential Remote Denial of Service impacting availability
• Need for verification of exposure in Withsecure Atlant deployments
• Potential need for updates or patches to address the vulnerability
• Limited information available about affected versions and remediation

Technical summary

The Withsecure Atlant antivirus engine, when using the Capricorn engine before version 2025-01-20_02, is susceptible to an out-of-bounds memory read during the processing of document files. This vulnerability can lead to a Remote Denial of Service. The out-of-bounds memory read occurs when the antivirus engine processes document files, potentially allowing an attacker to cause a denial-of-service condition. Defenders should prioritize verifying exposure in Withsecure Atlant deployments using the Capricorn engine before 2025-01-20_02, assessing the need for updates

Defensive priority

Defenders should prioritize verifying exposure in Withsecure Atlant deployments using the Capricorn engine before 2025-01-20_02, assessing the need for updates or compensating controls.

Recommended defensive actions

• Verify Withsecure Atlant deployments for use of the Capricorn engine before 2025-01-20_02
• Assess the need for updates or patches to address the out-of-bounds memory read vulnerability
• Consider implementing compensating controls to mitigate potential Remote Denial of Service risks

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details being an out-of-bounds memory read during document file processing by the antivirus engine, potentially leading to a Remote Denial of Service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.