Is CVE-2016-3644 actively exploited?

CVE-2016-3644 has no public evidence of in-the-wild exploitation as of 2025-04-12.

What is the CVSS score for CVE-2016-3644?

CVE-2016-3644 has a CVSS score of 8.4 (HIGH severity). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2016-3644?

Patch guidance is available from symantec security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2016-3644.

Fix CVE-2016-3644 - HIGH symantec norton security

Q: Which products are affected by CVE-2016-3644?

37 products: symantec norton security, symantec protection engine, symantec protection engine, symantec protection engine, symantec advanced threat protection, and 32 more.

Description

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message.

CVSS Metrics

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: local
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-20 · Improper Input Validation

Metadata

Primary Vendor: SYMANTEC
Published: 6/30/2016
Last Modified: 4/12/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

symantec : norton_securitysymantec : protection_enginesymantec : protection_enginesymantec : protection_enginesymantec : advanced_threat_protectionsymantec : norton_bootable_removal_toolsymantec : data_center_security_serversymantec : data_center_security_serversymantec : data_center_security_serversymantec : data_center_security_serversymantec : data_center_security_serversymantec : data_center_security_serversymantec : protection_for_sharepoint_serverssymantec : protection_for_sharepoint_serverssymantec : message_gateway_for_service_providerssymantec : message_gateway_for_service_providerssymantec : csapisymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : endpoint_protectionsymantec : norton_power_erasersymantec : mail_security_for_dominosymantec : mail_security_for_dominosymantec : mail_security_for_microsoft_exchangesymantec : mail_security_for_microsoft_exchangesymantec : mail_security_for_microsoft_exchangesymantec : message_gatewaysymantec : norton_360symantec : norton_antivirussymantec : norton_internet_securitysymantec : norton_securitysymantec : norton_security_with_backupsymantec : ngc

Remediation Guidance

Executive Summary

View on NIST NVD