CME identifiers (also called "CME numbers" and "CMEs")
are assigned in the format "CME-N" where
N is an integer between 1 and 999,
such as "CME-123". By minimizing the number of characters used initially,
most anti-virus products will be able to add the CME identifiers directly to
the names their products already display for users. Additional digits will be
added when the remaining unused identifier space becomes too small.
Each CME identifier recorded on the CME Web site includes following information associated with it:
- CME identifier number
- Description of the malware, and/or
- Vendor aliases with links to their malware encyclopedias or alerts
- Date/time assigned
As the list grows we will expand the information associated with each CME
identifier in order to provide first responders with additional insights about
the latest malware threats. Refer to The CME Process:
Scope, Identifiers, and Guidelines for Deconfliction for a complete discussion
of how CME identifiers are assigned and how we build and manage the CME
Incorporation of CME Identifiers by Anti-Virus Product Vendors
To accommodate space-deprived anti-virus products, CME identifiers can be abbreviated (e.g., M123 or M-123), but the official format (i.e., CME-123) should be used in places such as Web pages, alerts, encyclopedias, etc. For the sake of successful text-based comparisons, leading zeros will always be omitted in an identifier, e.g., CME-00123 will always be written as CME-123.
Organizations including CME identifiers in their products, Web sites, alerts,
encyclopedias, etc. are listed on the
Products and Services
Including CME Identifiers page.
The CME List includes all identifiers that have been assigned to-date.
Back to top