CVE-2007-2864: Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Compu

This week

HIGH 9.3DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2007-2864 is a high-severity flaw (CVSS 9.3) affecting anti-virus for the enterprise, brightstor arcserve backup, common services. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .CAB file.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.3 (High)
EPSS exploit chance	49.9% (top 1%)
CISA exploited list	No
Published	2007-06-06
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: broadcom

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2007-06-06 21:30 UTCPublished CVE record published
2026-06-16 22:40 UTCUpdated Record last modified

broadcom anti-virus for the enterprise DOWNGRADE

Affected: 8

Fixed in: no fixed release known

Safe to downgrade to: a release before 8

1. Check installed version

apt-cache policy anti-virus-for-the-enterprise || rpm -q anti-virus-for-the-enterprise || anti-virus-for-the-enterprise --version

2. No fixed release: DOWNGRADE to a release before 8 (Debian / Ubuntu)

apt-cache madison anti-virus-for-the-enterprise sudo apt install anti-virus-for-the-enterprise=<VERSION_BEFORE_8> sudo apt-mark hold anti-virus-for-the-enterprise

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list anti-virus-for-the-enterprise sudo dnf downgrade anti-virus-for-the-enterprise-<VERSION_BEFORE_8> sudo dnf versionlock add anti-virus-for-the-enterprise

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

broadcom brightstor arcserve backup DOWNGRADE

Affected: 9.01 · 10.5 · 11 · 11.1 · 11.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.01

1. Check installed version

apt-cache policy brightstor-arcserve-backup || rpm -q brightstor-arcserve-backup || brightstor-arcserve-backup --version

2. No fixed release: DOWNGRADE to a release before 9.01 (Debian / Ubuntu)

apt-cache madison brightstor-arcserve-backup sudo apt install brightstor-arcserve-backup=<VERSION_BEFORE_9.01> sudo apt-mark hold brightstor-arcserve-backup

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list brightstor-arcserve-backup sudo dnf downgrade brightstor-arcserve-backup-<VERSION_BEFORE_9.01> sudo dnf versionlock add brightstor-arcserve-backup

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

broadcom common services DOWNGRADE

Affected: 1.0 · 1.1 · 2.0 · 2.1 · 2.2 · 3.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0

1. Check installed version

apt-cache policy common-services || rpm -q common-services || common-services --version

2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)

apt-cache madison common-services sudo apt install common-services=<VERSION_BEFORE_1.0> sudo apt-mark hold common-services

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list common-services sudo dnf downgrade common-services-<VERSION_BEFORE_1.0> sudo dnf versionlock add common-services

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

broadcom etrust antivirus DOWNGRADE

Affected: 8.0 · 8.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.0

1. Check installed version

apt-cache policy etrust-antivirus || rpm -q etrust-antivirus || etrust-antivirus --version

2. No fixed release: DOWNGRADE to a release before 8.0 (Debian / Ubuntu)

apt-cache madison etrust-antivirus sudo apt install etrust-antivirus=<VERSION_BEFORE_8.0> sudo apt-mark hold etrust-antivirus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list etrust-antivirus sudo dnf downgrade etrust-antivirus-<VERSION_BEFORE_8.0> sudo dnf versionlock add etrust-antivirus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

broadcom etrust antivirus gateway DOWNGRADE

Affected: 7.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.1

1. Check installed version

apt-cache policy etrust-antivirus-gateway || rpm -q etrust-antivirus-gateway || etrust-antivirus-gateway --version

2. No fixed release: DOWNGRADE to a release before 7.1 (Debian / Ubuntu)

apt-cache madison etrust-antivirus-gateway sudo apt install etrust-antivirus-gateway=<VERSION_BEFORE_7.1> sudo apt-mark hold etrust-antivirus-gateway

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list etrust-antivirus-gateway sudo dnf downgrade etrust-antivirus-gateway-<VERSION_BEFORE_7.1> sudo dnf versionlock add etrust-antivirus-gateway

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

broadcom etrust antivirus sdk MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy etrust-antivirus-sdk || rpm -q etrust-antivirus-sdk || etrust-antivirus-sdk --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: CA AntiVirus Engine - CAB Buffer Overflow (Metasploit)
Metasploit: CA Antivirus Engine CAB Buffer Overflow

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2007-2864?

anti-virus for the enterprise: downgrade or apply the listed mitigation; brightstor arcserve backup: downgrade or apply the listed mitigation; common services: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2007-2864 being exploited?

CVE-2007-2864 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2007-2864 affect?

CVE-2007-2864 affects anti-virus for the enterprise, brightstor arcserve backup, common services. Severity is high (CVSS 9.3). Stack-based buffer overflow in the Anti-Virus engine before content update 30.6 in multiple CA (formerly Computer Associates) products allows remote attackers to execute arbitrary code via a large invalid value of the coffFiles field in a .

How urgent is CVE-2007-2864?

Priority 62/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference

Related CVEs

CVE-2009-3588 MEDIUM 4.3 DOWNGRADE DOWNGRADE Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise
CVE-2009-3587 HIGH 9.3 DOWNGRADE DOWNGRADE Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise
CVE-2009-0042 HIGH 10.0 DOWNGRADE DOWNGRADE Multiple unspecified vulnerabilities in the Arclib library (arclib.dll) before 7.3.0.15 in the CA Anti-Virus e
CVE-2007-4620 HIGH 9.0 DOWNGRADE DOWNGRADE Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.5
CVE-2007-3875 MEDIUM 4.3 DOWNGRADE UPGRADE arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows

References

← Back to latest CVEs