ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive.

published 2020-02-18 6y ago modified 2026-06-17 4mo ago also EUVD-2020-30093

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Security Premium, Internet Security, NOD32 Antivirus, Cyber Security Pro (macOS), Cyber Security (macOS), Mobile Security for Android, Smart TV Security, and NOD32 Antivirus 4 for Linux Desktop.

Patch / fix

fixed in 6

eset cyber_security 1296
eset internet_security 1296
eset mobile_security 1296
eset nod32_antivirus 1296
eset smart_security 1296
eset smart_tv_security 1296

Is CVE-2020-9264 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-436 Interpretation Conflict

References

support.eset.com /en/ca7387-modules-review-december-2019
release-notes
blog.zoller.lu /p/tzo-11-2020-eset-generic-malformed.html
third-party-advisory
seclists.org /fulldisclosure/2020/Feb/21
mailing-list, third-party-advisory

Sources

CVE List CVE-2020-9264
NVD CVE-2020-9264

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.