CVE-2021-25252
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a...
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
- Record
CVE-2021-25252- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
- Record
CVE-2021-25252- Updated
- 2026-11-02
EUVDEUVD-2021-12163 No score
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
- Record
EUVD-2021-12163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f392-jc49-593j No score
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a...
Trend Micro's Virus Scan API (VSAPI) and Advanced Threat Scan Engine (ATSE) - are vulnerable to a memory exhaustion vulnerability that may lead to denial-of-service or system freeze if exploited by an attacker using a specially crafted file.
- Record
GHSA-f392-jc49-593j- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
- trend micro virus scan api (vsapi) engine
- trendmicro apex central
- trendmicro apex one
- trendmicro cloud edge
- trendmicro control manager
- trendmicro deep discovery analyzer
- trendmicro deep discovery email inspector
- trendmicro deep discovery inspector
- trendmicro deep security
- trendmicro interscan messaging security virtual appliance
- trendmicro interscan web security virtual appliance
- trendmicro officescan
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25252 is a medium vulnerability (CVSS 5.5) in Trend Micro Virus Scan Api (vsapi) Engine, published March 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. No source names a fixed version.