CVE-2006-3454

CVE-2006-3454 describes multiple format string vulnerabilities in Symantec AntiVirus Corporate Edition (versions 8.1 to 10.0) and Client Security (versions 1.x to 3.0). These flaws allow a local attacker to execute arbitrary code by injecting malicious format strings into Tamper Protection or Virus Alert Notification messages. With a CVSS score of 7.2, this vulnerability is considered high severity, enabling complete compromise of confidentiality, integrity, and availability with low attack complexity and no authentication required. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.