ClamAV CVE-2020-37167

Exploitation requires the victim to load and execute an attacker-supplied ClamAV bytecode signature from an untrusted source through the ClamBC interpreter. Concretely this means either running the clambc analysis/testing tool on a malicious signature, or scanning with unsigned bytecode loading explicitly enabled - the non-default 'BytecodeUnsigned yes' clamd.conf setting or the clamscan '--bytecode-unsigned' flag - since bytecode inside digitally signed .c[lv]d files is normally trusted. The vendor added no code fix, only warnings, so the limiting factor is operator behavior: default configurations that only load Talos-signed signatures are not exposed. Attack is local (AV:L) and depends on this deliberate non-default trust decision.

This is a high-CVSS (8.6 CVSS 4.0) but low-real-world-priority issue whose signals are internally consistent once the actual attack model is understood. The provided CVSS 4.0 vector is AV:L/AC:L/PR:N/UI:N with full VC:H/VI:H/VA:H, implying trivial local code execution - but this contradicts the nature of the flaw: the ClamBC bytecode interpreter executes bytecode signatures, and arbitrary code execution only occurs when a user chooses to load and run bytecode from an untrusted source. The vendor's own 'fix' (commit cd2f2975) adds NO code hardening - it only adds documentation warnings ('You should NEVER run bytecode signatures from untrusted sources. Doing so may result in arbitrary code execution.') to man pages, config samples, and headers. This strongly indicates the behavior is by-design and the real gate is operator action, so the CVSS UI:N is questionable and should be UI:R/UI:P. EPSS is effectively zero (0.01%, 0th percentile) and there is no CISA KEV listing, consistent with a flaw requiring the victim to deliberately run malicious signatures. Publicly available exploit code exists (Exploit-DB 47687), which raises reproducibility but not opportunistic mass-exploitation likelihood. Note the input Tag 'Information Disclosure' conflicts with the described impact (arbitrary bytecode/code execution, VC/VI/VA:H) - verify tag against advisory.

An attacker crafts a malicious ClamAV bytecode signature (.cbc) abusing weak function-name encoding validation in the ClamBC interpreter and distributes it as a seemingly legitimate signature. A victim who runs untrusted bytecode - via the clambc tool, or with unsigned bytecode loading enabled (BytecodeUnsigned yes / --bytecode-unsigned) - triggers arbitrary code execution in the ClamAV engine's context. Public exploit code exists (Exploit-DB 47687), lowering the barrier to reproduction.