CVE-2005-0644: Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4436 allows remote attackers to execute...

Security readout for executives and security teams

This is an old McAfee antivirus scanning flaw. A specially malformed LHA archive could trigger a buffer overflow in McAfee Scan Engine 4320 when its DAT files were older than version 4436, potentially allowing attacker-controlled code to run in the scanner context. Exposure is most likely in legacy environments still running McAfee Scan Engine 4320 with DAT files older than 4436, especially systems that automatically scan inbound archives such as mail gateways, file-upload paths, or shared storage scanners. Treat as high priority only where legacy McAfee scanning remains in use. The issue allows code execution in security infrastructure, but the CVE is from 2005 and the provided evidence does not show current active exploitation. Mitigation focus: Update McAfee DAT files to version 4436 or later.; Review McAfee’s March 17, 2005 security bulletin for vendor-specific guidance.; Retire or isolate any legacy Scan Engine 4320 deployments that cannot be updated..

Prepared

Jun 29, 2026, 23:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.