CVE-2005-2758

CVE-2005-2758 describes an integer signedness error in the administrative interface of Symantec AntiVirus Scan Engine versions 4.0 and 4.3, including the Network Attached Storage variant. This flaw allows unauthenticated remote attackers to execute arbitrary code by sending crafted HTTP headers containing negative values, leading to a heap-based buffer overflow. With a CVSS score of 10.0, this vulnerability is critical, indicating a network-based attack with low complexity, requiring no authentication, and resulting in complete compromise of confidentiality, integrity, and availability. Despite its high severity and EPSS score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.