# CVE-2026-20218: Cisco Snort 3 VBA decompression buffer overflow denial of service

Source: https://junglewise.ai/threats/cve-2026-20218-a-vulnerability-in-the-snort-3-visual-basic-for-applications-vba  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-20218 · Severity: medium · CVSS 5.8 · Published 2026-10-21

A flaw in Snort 3's Visual Basic macro decompression engine allows remote attackers to crash the detection engine by sending crafted VBA data, disrupting network security monitoring. The vulnerability affects Snort 3 integrated into Cisco Secure Firewall Threat Defense and IOS XE-based routers and edge platforms. A successful attack causes the Snort detection engine to restart unexpectedly, creating a window where network intrusions may go undetected.

Technologies: [Cisco IOS XE Unified Threat Defense](https://junglewise.ai/threats/technologies/ios-xe-unified-threat-defense), [Cisco Secure Firewall Threat Defense](https://junglewise.ai/threats/technologies/firepower-threat-defense), [Cisco Snort 3](https://junglewise.ai/threats/technologies/snort-3). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20218 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20218 being exploited in the wild.

**How severe is CVE-2026-20218?** Medium severity, with a CVSS score of 5.8, published 21 October 2026.

**Which products and versions are affected?** Cisco Secure Firewall Threat Defense 7.2.0 and later.

**Is there a fix for CVE-2026-20218?** No fixed version is recorded yet. VBA macro decompression is not enabled by default; disable Snort 3 VBA macro decompression on intrusion policies if this feature is not required for your security posture. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20218 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-20218?** Check whether you run Cisco IOS XE Unified Threat Defense, Cisco Secure Firewall Threat Defense or Cisco Snort 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


VBA macro decompression is not enabled by default; disable Snort 3 VBA macro decompression on intrusion policies if this feature is not required for your security posture.

## Technical details

The vulnerability stems from improper range checking in the Snort 3 VBA decompression engine when processing user-controlled VBA macro data, leading to a stack-based buffer overflow. An unauthenticated remote attacker can exploit this by sending crafted VBA data (via IMAP, SMTP, HTTP, or POP3) to a device with Snort 3 active and VBA macro decompression enabled. A successful exploit causes the Snort 3 Detection Engine to restart, resulting in denial of service; VBA macro decompression is not enabled by default, limiting exposure.

## Affected products

- Cisco Snort 3
- Cisco Secure Firewall Threat Defense 7.2.0 and later
- Cisco IOS XE Unified Threat Defense

## Timeline

- 2026-10-21: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9)

## Related threats

- [Cisco Snort 3 memory management denial of service](https://junglewise.ai/threats/cve-2026-76489-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 Detection Engine denial of service in GTP codec](https://junglewise.ai/threats/cve-2026-76445-multiple-cisco-products-are-affected-by-a-vulnerability-in-the)
- [Cisco Snort 3 uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-20356-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 improper privilege management](https://junglewise.ai/threats/cve-2026-20291-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Snort 3 incorrect calculation vulnerability](https://junglewise.ai/threats/cve-2026-20236-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)