Emsisoft
Bug bounty on security.txt emsisoft.com
Accepting reports
security.txt expired
mentions bounty
- Top reward
- $500
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 20
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- top reward.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$500
we pay up to $500 USD per accepted security vulnerability
- Response
-
Within 10 days
it may take us up to 10 business days to review and respond
- Safe harbor
-
Partial
our bug bounty program will only reward researchers who follow responsible disclosure guidelines and never disclose any information about the vulnerability to the public or any entity other than Emsisoft before the issue has been fixed and the fix has been rolled out to our customers.
- Hall of fame
-
Yes
we also give credit to researchers in our release notes
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 2 excluded.
Domains 1
- emsisoft.com
Out of scope (2)
- store.emsisoft.com
- support.emsisoft.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Emsisoft's policy. "We" in these lines means the program, not this site.
While testing
-
never disclose any information about the vulnerability to the public or any entity other than Emsisoft before the issue has been fixed and the fix has been rolled out to our customers.
-
We require a working proof-of-concept and won’t accept any automated reports or reports for theoretical issues.
-
Please include as much information as possible in your submission, but as a minimum we expect steps to reproduce the vulnerability and an explanation of why you consider it as such.
-
remember to mark it as private if you use any public hosting or streaming services like YouTube.
Not accepted
-
Non-detection of malware or protection bypasses, with the exception of bypasses that can’t be fixed with the addition of additional rules or signatures.
-
Issues that are non-exploitable but lead to crashes, information leaks, or stability issues.
-
Descriptive error messages (e.g. Stack traces, application or server errors).
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
-
Banner disclosure on common/public services.
-
Disclosure of known public files or directories, (e.g. robots.txt, publicly accessible login forms).
-
Clickjacking and issues only exploitable through clickjacking.
-
Self-XSS and issues exploitable only through Self-XSS.
-
CSRF on forms that are available to the public without registration (e.g. the contact form).
-
Logout Cross-Site Request Forgery (logout CSRF).
-
Presence of application or web browser “autocomplete” or “save password”.
-
Issues that require physical access to the device to carry out the exploit.
-
Theoretical issues that lack practical severity.
-
Mail configuration issues related to DKIM, DMARC or SPF.
-
Missing security headers, SSL configuration issues, as well as non-secure elements being pulled into secure sites.
-
Vulnerabilities where a fix is not feasible.
-
Redirect issues, unless the redirect can be used to exfiltrate sensitive information (authentication tokens for example).
-
Non-amplified bruteforce attacks.
-
Attacks relying on social engineering or access to the user’s email account, unless access to said account was obtained through a vulnerability in our products.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2019-7651 | EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not properly protected, leading to unintended impersonation or object creation. This vulnerability has been fixed in version 2018.12 and later. | High 7.5 | 8 Feb 2019 |
| CVE-2012-1459 | The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160 | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1461 | The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (for | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1462 | The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3. | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1448 | The CAB file parser in Quick Heal (aka Cat QuickHeal) 11.00, Trend Micro AntiVirus 9.120.0.1004, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Trend Micro HouseCall 9.120.0.1004, and Emsisoft Anti-Malware 5.1.0.1 allows remote attackers to bypass malware detection via a CAB file with a modified cbCabinet field. NOTE: this may later be SPLIT into multiple CVEs if additional information i | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1450 | The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Sophos Anti-Virus 4.61.0, and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 allows remote attackers to bypass malware detection via a CAB file with a modified reserved3 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser im | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1451 | The CAB file parser in Emsisoft Anti-Malware 5.1.0.1 and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 allows remote attackers to bypass malware detection via a CAB file with a modified reserved2 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1452 | The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a CAB file with a modified reserved1 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different C | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1453 | The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly Webwasher) 2010.1C, Emsisoft Anti-Malware 5.1.0.1, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Rising Antivirus 22. | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1456 | The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (f | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1457 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, J | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1429 | The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, and nProtect Anti-Virus 2011-01-17.01 allows remote attackers to bypass malware detection via an ELF file w | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1432 | The Microsoft EXE file parser in Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \57\69\6E\5A\69\70 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing th | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1433 | The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additiona | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1434 | The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1435 | The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \50\4B\4C\49\54\45 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if add | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1436 | The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \2D\6C\68 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional i | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1443 | The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0.1, PC Tools AntiVirus 7.0.3.5, F-Prot Antivirus 4.6.2.117, VirusBuster 13.6.151.0, Fortinet Antivirus | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1423 | The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware dete | Medium 4.3 | 21 Mar 2012 |
| CVE-2012-1425 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivir | Medium 4.3 | 21 Mar 2012 |