Network attacking using malware has become very popular on the Internet and in many other networks, namely Vehicular Ad-hoc Network (VANET) networks. It is required to have the model describing the malware spreading based on factors, which directly affect this process to limit its influences. In this paper, we propose a mathematical model called SEIR-S (Susceptible–Exposed–Infectious–Recovered–Susceptible) based on the characteristics of the VANET network and the well-known disease-spreading model SIR (Susceptible–Infectious–Recovered). We take into account possible behaviors of malware and provide the corresponding states to vehicles: Susceptible (S), Exposed (E), Infectious (I), Recovered (R). We evaluate the basic reproduction number ${\mathit{R}}_0$ of the model and perform a stability analysis of the proposed model. The results show that, when ${\mathit{R}}_0$ < 1, the malware spreading will gradually decrease, and, when ${\mathit{R}}_0$ > 1, that spreading cannot be extinguished. We also point out the condition that we can control the endemic in the VANET network. In addition, the correctness of the proposed model is verified using both numerical analysis and agent-based simulation on NetLogo.