CVE-2012-1427: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Viru...

Security readout for executives and security teams

CVE-2012-1427 is an antivirus detection bypass affecting TAR archive parsing in specific older Quick Heal, Norman Antivirus, and Sophos Anti-Virus versions. A crafted POSIX TAR file could evade malware scanning, meaning malicious content might pass through controls that depend on those engines. Exposure is most likely in legacy environments still using the named antivirus versions, especially mail gateways, web proxies, file-upload scanning, or endpoint controls that inspect TAR archives with those engines. Treat as a targeted legacy-control risk. It is not currently supported by evidence of active exploitation, but affected antivirus deployments could create a blind spot for malicious archives. Mitigation focus: Identify any use of the named antivirus products and versions.; Check vendor guidance for fixed versions or recommended configuration changes.; Upgrade or replace unsupported antivirus engines where present..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.