CVE-2016-2211

Exploitation likely. EPSS gives it a 53% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.8High EPSS percentile99th53% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-06-30Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which of these you run (Symantec/Norton mail security, endpoint protection/“protection engine”, message gateway/web gateway, Norton Power Eraser): and record the exact product and version/build.
Compare your version against the affected ranges in the vendor advisory for CVE-2016-2211 (the advisory link in your IT ticket).
Upgrade or patch to the vendor-fixed version(s) listed in the Symantec security advisory for CVE-2016-2211.
If you cannot patch right away, reduce exposure to untrusted CAB files reaching the affected decompression component (for example, limit or quarantine file attachments and downloads that deliver CABs to the scanning components) and keep the system under closer monitoring until upgraded.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CAB file that is mishandled during decompression.

In plain language

Written by AI from the record

CVE-2016-2211 is a Symantec product weakness where specially made compressed files (CABs) can crash the scanner or potentially run bad code; if you use affected Symantec/Norton security or message-gateway products, you should patch soon.

CVE-2016-2211 is a memory corruption issue in Symantec’s AntiVirus Decomposer engine that can be triggered by a crafted CAB file during decompression, leading to denial of service and potentially arbitrary code execution in several Symantec ATP/Endpoint/Web/Message Gateway and Norton products (affected version ranges in the advisory).

If you're affected

Email/web security outages
Malware detection bypass risk
Potential server or endpoint compromise
Business disruption from crashes

What is it

This bug is like a “file unzipper” inside Symantec’s security software. If someone sends a specially constructed compressed file (a CAB file), the unzipper can be tricked into crashing (denial of service) and, in some cases, potentially misbehave in a way that lets malicious code run.

Who is affected

This matters if your business runs or manages affected Symantec/Norton security and message-scanning products (mail security for Microsoft Exchange, endpoint/protection engine, message gateway/web gateway, or related Norton security products) on servers or endpoints. It is mainly a risk when an attacker can get a crafted CAB file into a place your Symantec/Norton decompression engine will process it (for example, through scanned email/web content or files handled by the affected product).

How urgent is it

This is an AMBER issue: it’s high impact because the bug can cause crashes and may allow arbitrary code execution when a crafted CAB file is processed. While there’s no confirmed public exploit code or KEV listing in the provided findings, the predicted likelihood is relatively high and rising, so you should patch as part of your next urgent maintenance window.

What to do — in detail

Confirm exposure

Identify the exact Symantec/Norton components you have deployed that relate to the AntiVirus Decomposer engine (based on the affected product list in the CVE title).
For each component, capture the installed product name and version (including update/patch levels).
Check whether your versions fall into any affected ranges described by the vendor advisory linked for CVE-2016-2211.

Apply the fix

Use the Symantec security advisory linked in the findings for CVE-2016-2211 to select the correct fixed version for each affected product line.
Upgrade each affected product to the vendor-fixed release(s) specified in that advisory.
After upgrading, verify service health (the product services/components come back cleanly, and file scanning still works normally).

If you can’t patch immediately

Reduce the chance that untrusted CAB files reach the scanning/decompression component—practically, this means tightening attachment/file handling paths that deliver compressed files to the affected engine (for example, quarantining suspicious attachments and filtering CAB-containing content where feasible).
Increase monitoring around crashes or scanning-component restarts until the upgrade is complete.

What to monitor

Look for abnormal reboots/service crashes/restarts of the Symantec security components and related mail/web gateway scanning services.
If you have logs that record scanning/decompression failures for CAB files, review for repeated failures consistent with malformed inputs.

Technical context

CVE-2016-2211 (CWE-119) relates to memory corruption in Symantec’s AntiVirus Decomposer engine when processing a crafted CAB file during decompression. The outcome can include denial of service and, depending on conditions, arbitrary code execution. The provided findings do not list it in CISA KEV and there is no public exploit code on record; however, predicted likelihood is relatively high and rising. Patch guidance exists via Symantec’s security advisory (June 2016 reference), which provides fixed releases for the listed Symantec ATP/SDCS:S/Web Gateway/Endpoint/Protection Engine and multiple Norton product lines within specific version ranges.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

53% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

25 events over 3737 days, from the signal feeds we watch.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-29EPSS band changehigh → moderate

Affected products

symanteccommercial · USaka symantec enterprise security, norton
Broadcom Inc.commercial · USaka vmware by broadcom
- Broadcom Message GatewaySecurity ProductOn-premSecurity Products / secure-gateway-vpn
- Broadcom End-User Security: Advanced Threat ProtectionSecurity ProductOn-premSecurity Products / vuln-mgmt-scanner
- Symantec Protection Engine (SPE)Security ProductOn-premSecurity Products / vuln-mgmt-scanner
- Broadcom Symantec Mail Security for DominoSecurity ProductOn-premSecurity Products
- Symantec Endpoint ProtectionSecurity ProductOn-premSecurity Products / endpoint-av-edr
- Broadcom Symantec Protection for SharePoint ServersSecurity ProductOn-premSecurity Products / vuln-mgmt-scanner
- Broadcom Symantec Mail Security for Microsoft ExchangeSecurity ProductOn-premSecurity Products
- Symantec Content Security API (CSAPI)Security ProductOn-premSecurity Products / vuln-mgmt-scanner
Gen Digitalcommercial · USaka norton
- Norton 360MixedSecurity Products / endpoint-av-edr
- Norton Power EraserMixedSecurity Products / endpoint-av-edr
- Norton AntiVirusSecurity ProductOn-premSecurity Products / endpoint-av-edr
- Norton Bootable Recovery ToolMixedSecurity Products / endpoint-av-edr

And 13 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable