CVE-2016-2211

Published: Jun 30, 2016Updated: May 6, 2026 Sources: CVE List NVD BDUCWE-119

7.8HIGH

NVD MITRE

Description

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CAB file that is mishandled during decompression.

In plain language

AI Worth attention

CVE-2016-2211 is a Symantec product weakness where specially made compressed files (CABs) can crash the scanner or potentially run bad code; if you use affected Symantec/Norton security or message-gateway products, you should patch soon.

Executive summary

CVE-2016-2211 is a memory corruption issue in Symantec’s AntiVirus Decomposer engine that can be triggered by a crafted CAB file during decompression, leading to denial of service and potentially arbitrary code execution in several Symantec ATP/Endpoint/Web/Message Gateway and Norton products (affected version ranges in the advisory).

If affected, business impact

Email/web security outagesMalware detection bypass riskPotential server or endpoint compromiseBusiness disruption from crashes

What to do now

Check which of these you run (Symantec/Norton mail security, endpoint protection/“protection engine”, message gateway/web gateway, Norton Power Eraser): and record the exact product and version/build.
Compare your version against the affected ranges in the vendor advisory for CVE-2016-2211 (the advisory link in your IT ticket).
Upgrade or patch to the vendor-fixed version(s) listed in the Symantec security advisory for CVE-2016-2211.
If you cannot patch right away, reduce exposure to untrusted CAB files reaching the affected decompression component (for example, limit or quarantine file attachments and downloads that deliver CABs to the scanning components) and keep the system under closer monitoring until upgraded.

Patch / advisory Some work to apply

What is it

This bug is like a “file unzipper” inside Symantec’s security software. If someone sends a specially constructed compressed file (a CAB file), the unzipper can be tricked into crashing (denial of service) and, in some cases, potentially misbehave in a way that lets malicious code run.

Who is affected

This matters if your business runs or manages affected Symantec/Norton security and message-scanning products (mail security for Microsoft Exchange, endpoint/protection engine, message gateway/web gateway, or related Norton security products) on servers or endpoints. It is mainly a risk when an attacker can get a crafted CAB file into a place your Symantec/Norton decompression engine will process it (for example, through scanned email/web content or files handled by the affected product).

How urgent is it

This is an AMBER issue: it’s high impact because the bug can cause crashes and may allow arbitrary code execution when a crafted CAB file is processed. While there’s no confirmed public exploit code or KEV listing in the provided findings, the predicted likelihood is relatively high and rising, so you should patch as part of your next urgent maintenance window.

What to do — in detail

Confirm exposure

Identify the exact Symantec/Norton components you have deployed that relate to the AntiVirus Decomposer engine (based on the affected product list in the CVE title).
For each component, capture the installed product name and version (including update/patch levels).
Check whether your versions fall into any affected ranges described by the vendor advisory linked for CVE-2016-2211.

Apply the fix

Use the Symantec security advisory linked in the findings for CVE-2016-2211 to select the correct fixed version for each affected product line.
Upgrade each affected product to the vendor-fixed release(s) specified in that advisory.
After upgrading, verify service health (the product services/components come back cleanly, and file scanning still works normally).

If you can’t patch immediately

Reduce the chance that untrusted CAB files reach the scanning/decompression component—practically, this means tightening attachment/file handling paths that deliver compressed files to the affected engine (for example, quarantining suspicious attachments and filtering CAB-containing content where feasible).
Increase monitoring around crashes or scanning-component restarts until the upgrade is complete.

What to monitor

Look for abnormal reboots/service crashes/restarts of the Symantec security components and related mail/web gateway scanning services.
If you have logs that record scanning/decompression failures for CAB files, review for repeated failures consistent with malformed inputs.

Technical context

CVE-2016-2211 (CWE-119) relates to memory corruption in Symantec’s AntiVirus Decomposer engine when processing a crafted CAB file during decompression. The outcome can include denial of service and, depending on conditions, arbitrary code execution. The provided findings do not list it in CISA KEV and there is no public exploit code on record; however, predicted likelihood is relatively high and rising. Patch guidance exists via Symantec’s security advisory (June 2016 reference), which provides fixed releases for the listed Symantec ATP/SDCS:S/Web Gateway/Endpoint/Protection Engine and multiple Norton product lines within specific version ranges.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.