What is the CVSS score of CVE-2020-37167?

CVE-2020-37167 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2020-37167?

Yes, a public proof-of-concept exploit is available for CVE-2020-37167. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-37167?

Within 24 hours: Inventory all ClamAV deployments and identify systems running versions up to 0.103.0; isolate or restrict internet access to affected systems if operationally feasible. Within 7 days: Implement network segmentation to limit lateral movement from compromised scanning endpoints; deploy enhanced logging on ClamAV systems to detect suspicious bytecode manipulation attempts. Within 30 days: Upgrade ClamAV to the latest patched version when available; review and strengthen file upload filtering controls; conduct threat hunt for indicators of exploitation.

Suse CVE-2020-37167

Q: Which versions of Suse are affected by CVE-2020-37167?

ClamAV versions up to 0.103.0 contain a high-severity vulnerability (CVSS 8.4) that allows attackers to manipulate bytecode function names, potentially bypassing malware detection and enabling…. A patch is available.

HIGH

2026-02-12 disclosure@vulncheck.com

Information Disclosure Suse

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 27, 2026 - 22:16 vuln.today

Public exploit code

CVE Published

Feb 12, 2026 - 23:16 nvd

HIGH 8.4

DescriptionCVE.org

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

AnalysisAI

ClamAV versions up to 0.103.0 contains a vulnerability that allows attackers to manipulate bytecode function names (CVSS 8.4).

Technical ContextAI

exists in the a vulnerability in component. ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

Affected ProductsAI

Product: ClamAV. Versions: up to 0.103.0. Component: a vulnerability in.

RemediationAI

Monitor vendor advisories for a patch.

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP7	Fixed

CVE-2020-37167 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP4	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP5	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP6	Fixed
SUSE Linux Enterprise Server 12 SP5	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security	Fixed
SUSE Linux Enterprise Server 15 SP4	Fixed
SUSE Linux Enterprise Server 15 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP5	Fixed
SUSE Linux Enterprise Server 15 SP5-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP6	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Manager Proxy 4.3	Fixed
SUSE Manager Proxy LTS 4.3	Fixed
SUSE Manager Retail Branch Server 4.3	Fixed
SUSE Manager Retail Branch Server LTS 4.3	Fixed
SUSE Manager Server 4.3	Fixed
SUSE Manager Server LTS 4.3	Fixed
SUSE CaaS Platform 4.0	Fixed
SUSE Enterprise Storage 6	Fixed
SUSE Enterprise Storage 7	Fixed
SUSE Enterprise Storage 7.1	Fixed
SUSE Linux Enterprise Desktop 12	Fixed
SUSE Linux Enterprise Desktop 12 SP1	Fixed
SUSE Linux Enterprise Desktop 12 SP2	Fixed
SUSE Linux Enterprise Desktop 12 SP3	Fixed
SUSE Linux Enterprise Desktop 12 SP4	Fixed
SUSE Linux Enterprise Desktop 15	Fixed
SUSE Linux Enterprise Desktop 15 SP1	Fixed
SUSE Linux Enterprise Desktop 15 SP2	Fixed
SUSE Linux Enterprise Desktop 15 SP3	Fixed
SUSE Linux Enterprise Desktop 15 SP4	Fixed
SUSE Linux Enterprise Desktop 15 SP5	Fixed
SUSE Linux Enterprise Desktop 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15-LTSS	Fixed
SUSE Linux Enterprise Module for Basesystem 15	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP1	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP2	Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP3	Fixed
SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT	Fixed
SUSE Linux Enterprise Real Time 15 SP2	Fixed
SUSE Linux Enterprise Real Time 15 SP3	Fixed
SUSE Linux Enterprise Real Time 15 SP4	Fixed
SUSE Linux Enterprise Server 12	Fixed
SUSE Linux Enterprise Server 12 SP1	Fixed
SUSE Linux Enterprise Server 12 SP1-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP2	Fixed
SUSE Linux Enterprise Server 12 SP2-BCL	Fixed
SUSE Linux Enterprise Server 12 SP2-ESPOS	Fixed
SUSE Linux Enterprise Server 12 SP2-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP3	Fixed
SUSE Linux Enterprise Server 12 SP3-BCL	Fixed
SUSE Linux Enterprise Server 12 SP3-ESPOS	Fixed
SUSE Linux Enterprise Server 12 SP3-LTSS	Fixed
SUSE Linux Enterprise Server 12 SP4	Fixed
SUSE Linux Enterprise Server 12 SP4-ESPOS	Fixed
SUSE Linux Enterprise Server 12 SP4-LTSS	Fixed
SUSE Linux Enterprise Server 12-LTSS	Fixed
SUSE Linux Enterprise Server 15	Fixed
SUSE Linux Enterprise Server 15 SP1	Fixed
SUSE Linux Enterprise Server 15 SP1-BCL	Fixed
SUSE Linux Enterprise Server 15 SP1-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP2	Fixed
SUSE Linux Enterprise Server 15 SP2-BCL	Fixed
SUSE Linux Enterprise Server 15 SP2-LTSS	Fixed
SUSE Linux Enterprise Server 15 SP3	Fixed
SUSE Linux Enterprise Server 15 SP3-BCL	Fixed
SUSE Linux Enterprise Server 15 SP3-LTSS	Fixed
SUSE Linux Enterprise Server 15-LTSS	Fixed
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP1	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 12 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP1	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP2	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP3	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Manager Proxy 4.0	Fixed
SUSE Manager Proxy 4.1	Fixed
SUSE Manager Proxy 4.2	Fixed
SUSE Manager Retail Branch Server 4.0	Fixed
SUSE Manager Retail Branch Server 4.1	Fixed
SUSE Manager Retail Branch Server 4.2	Fixed
SUSE Manager Server 4.0	Fixed
SUSE Manager Server 4.1	Fixed
SUSE Manager Server 4.2	Fixed
SUSE OpenStack Cloud 7	Fixed
SUSE OpenStack Cloud 8	Fixed
SUSE OpenStack Cloud 9	Fixed
SUSE OpenStack Cloud Crowbar 8	Fixed
SUSE OpenStack Cloud Crowbar 9	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed

Suse CVE-2020-37167

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code