CVE-2022-27534

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security	with antivirus databases released before 12.03.2022

References

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275357.8Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Servic CVE-2022-275367.5Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certifica CVE-2022-275377.8Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc CVE-2022-275387.0A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow a CVE-2022-275397.8Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all CVE-2022-27549.8The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using the CVE-2022-275407.8A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might a CVE-2022-275417.8Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may all CVE-2022-275446.5BigFix Web Reports authorized users may see SMTP credentials in clear text.CVE-2022-275455.4BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.CVE-2022-275466.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input suppl CVE-2022-275477.4HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supp