Cisco warns of a ClamAV bug with PoC exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20032 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. NVD description · AI analysis pending | 9.8 | 29% |
| — | ||
| CVE-2025-20128 | A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of s A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. NVD description · AI analysis pending | 7.5 | 2% |
| — |
Full article415 words · extracted from securityaffairs.com · click to collapse
Cisco addressed a ClamAV denial-of-service (DoS) vulnerability, and experts warn of the availability of a proof-of-concept (PoC) exploit code.
Cisco has released security updates to address a ClamAV denial-of-service (DoS) vulnerability tracked as CVE-2025-20128. The Cisco PSIRT experts warn of the availability of a proof-of-concept (PoC) exploit code for this flaw.
The vulnerability resides in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV. An unauthenticated, remote attacker could exploit the flaw to cause a denial of service (DoS) condition on a vulnerable device.
Cisco ClamAV (Clam AntiVirus) is an open-source antivirus engine designed to detect malware, viruses, and other malicious threats. It is widely used for email scanning, file scanning, and web security, particularly in Linux-based systems.
“This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device.” reads the advisory. “A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.”
The Medium-impact vulnerability affects Linux, Mac, and Windows, potentially crashing scans and delaying or halting scanning operations.
The vulnerability impacts the following products:
| Affected Cisco Software Platform | CVSS Base Score | Security Impact Rating | Cisco Bug ID | First Fixed Release |
|---|---|---|---|---|
| Secure Endpoint Connector for Linux | 6.9 | Medium | CSCwm89778 | 1.25.1 |
| Secure Endpoint Connector for Mac | 6.9 | Medium | CSCwm89779 | 1.24.4 |
| Secure Endpoint Connector for Windows | 6.9 | Medium | CSCwm89781 | 7.5.20 8.4.3 |
| Secure Endpoint Private Cloud | 6.9 | Medium | CSCwm91582 | 4.2.0 with updated connectors |
The Cisco PSIRT is not aware of attacks in the wild exploiting this vulnerability.
Google OSS-Fuzz reported this vulnerability.
In February 2023, Cisco fixed a critical flaw, tracked as CVE-2023-20032 (CVSS score: 9.8), in ClamAV product. The vulnerability resides in the HFS+ file parser component, an attacker can trigger the issue to gain remote code execution on vulnerable devices or trigger a DoS condition.
Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser.
The flaw affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. The company acknowledged Simon Scannell from Google for reporting this issue.
The vulnerability is a buffer overflow issue affecting the ClamAV scanning library, it is due to a missing buffer size check.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ClamAV)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/173446/uncategorized/cisco-fixed-clamav-dos-flaw.html