A major remote code execution vulnerability has been discovered in products from Kaspersky Lab, which pushed out a patch to customers in early April. The flaw, called CVE-2019-8285 and assigned a CVSS score of 8.0, was reported to Kaspersky by a team called “Imaginary.” The experts found a way to remotely execute arbitrary code by exploiting a heap-based buffer overflow.
Researchers believe the attackers could have manipulated the flaw to execute an arbitrary code with SYSTEM privileges by scanning a specially crafted JavaScript file.
According to Kaspersky, software using antivirus databases have been impacted.
It is believed that the flaw existed in the company’s antivirus engine and several impacted versions of Kaspersky Antivirus have been listed.