Snort 3's VBA inspection engine has a critical flaw: ZDI-26-788/CVE-2026-20218 is a stack-based buffer overflow rated 8.1 RCE, though Cisco calls it DoS. Independent RCE https://deafnews.it/en/article/snort-3-bug-when-the-vba-inspection-engine-becomes-an-attack-vector