Skip to main content

CISA alerts on antivirus and EDR failing to scan malformed ZIPs

Source Decision Insights Threat Desk Published March 9, 2026 Companies 1
Human View Machine View

34th article in the last 90 days, one of 522 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: Digital Realty Supermicro Huawei and partners updates - Week of March 9, 2026 (Mar 2026).

Companies mentioned

Best suited for

Seniority
Architect
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Architect / Technical Evaluator
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Antivirus and Endpoint Detection And Response (EDR) archive-scanning engines can fail to detect malicious payloads when ZIP archive metadata is malformed, allowing a compressed payload to remain hidden until decompression and potential execution.

Technical details include Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-0866 and a noted similarity to VU#968818, CVE-2004-0935. ZIP archives carry metadata such as compression method, flags, and version information; altering the compression method field can cause antivirus engines to not decompress an entry. A custom loader that ignores the declared Method field can instead decompress embedded data directly. Standard extraction tools including 7‑Zip, unzip, bsdtar, and Python’s zipfile trust the declared compression method, attempt decompression, then fail with CRC or “unsupported method” errors and do not expose the underlying data. Date Public: 2004-12-10; Date First Published: 2026-03-09; Date Last Updated: 2026-03-09 16:09 UTC; Document Revision: 1.

A remote attacker may craft a ZIP archive with tampered metadata that prevents antivirus or EDR software from properly decompressing and inspecting its contents. The file can evade full analysis while many products will flag it as corrupted. To run malicious code, a user must extract or otherwise process the archive; standard extraction tools may or may not reveal the hidden payload. A custom loader that ignores the declared compression method could recover and execute the concealed content.

Antivirus and EDR vendors should not rely solely on declared archive metadata to determine content handling. Scanners should implement more aggressive detection modes that validate compression method fields against actual content characteristics and flag inconsistencies for further inspection. No vendor-specific fixes are listed in this advisory.

Users are encouraged to contact their antivirus or EDR providers to determine whether they are affected and to obtain guidance on available mitigation options. Acknowledgements in the advisory name reporter Christopher Aziz and author Laurie Tyzenhaus.

Blog post, originally published by Laurie Tyzenhaus at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-antivirus-and-edr-failing-to-scan-malformed-zips/",
        "name": "CISA alerts on antivirus and EDR failing to scan malformed ZIPs",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-antivirus-and-edr-failing-to-scan-malformed-zips/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Architect / Technical Evaluator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:08:59-06:00",
    "datePublished": "2026-03-09T13:11:03-06:00",
    "description": "Malformed ZIP archives: CISA details how modified compression metadata can prevent antivirus and EDR scanners from inspecting archive contents.",
    "headline": "CISA alerts on antivirus and EDR failing to scan malformed ZIPs",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Laurie Tyzenhaus"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/976247"
    },
    "keywords": [
      "Antivirus",
      "Common Vulnerabilities and Exposures",
      "Endpoint Detection And Response",
      "Metadata"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-antivirus-and-edr-failing-to-scan-malformed-zips/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/projects/python/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/python/",
        "name": "Python"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages