Skip to main content

Clamav CVE-2025-20128

MEDIUM
Heap-based Buffer Overflow (CWE-122)
2025-01-22 psirt@cisco.com
Heap Overflow Cisco Buffer Overflow Denial Of Service Clamav Secure Endpoint Secure Endpoint Private Cloud Suse
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch released
Apr 05, 2026 - 02:30 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 18:05 vuln.today
CVE Published
Jan 22, 2025 - 17:15 nvd
MEDIUM 5.3

DescriptionCVE.org

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

AnalysisAI

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-122. A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Affected products include: Clamav, Cisco Secure Endpoint, Cisco Secure Endpoint Private Cloud.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Clamav

View all
CVE-2012-1459 MEDIUM
4.3 Mar 21

The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,

CVE-2012-1457 MEDIUM
4.3 Mar 21

The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
CVE-2012-1443 MEDIUM
4.3 Mar 21

The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
CVE-2014-9050 MEDIUM POC
5.0 Dec 01

Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers

CVE-2025-20260 CRITICAL
9.8 Jun 18

A remote code execution vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated (CVSS 9.8).
CVE-2014-9328 HIGH
7.5 Feb 03

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "h
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2016-1372 MEDIUM POC
5.5 Oct 03

ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a
CVE-2016-1371 MEDIUM POC
5.5 Oct 03

ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a
CVE-2019-1798 MEDIUM POC
5.5 Apr 08

A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions
CVE-2019-1788 MEDIUM POC
5.5 Apr 08

A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software
CVE-2019-1787 MEDIUM POC
5.5 Apr 08

A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software version

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2023-6246 HIGH POC
8.4
CVE-2026-42945 CRITICAL POC
9.2
CVE-2014-0781 CRITICAL POC
9.3
CVE-2024-30085 HIGH POC
7.8

Same technique Heap Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2025-5419 HIGH POC
8.8
CVE-2025-21418 HIGH
7.8
CVE-2023-6246 HIGH POC
8.4
CVE-2026-42945 CRITICAL POC
9.2
CVE-2014-0781 CRITICAL POC
9.3
CVE-2024-30085 HIGH POC
7.8
CVE-2024-30038 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2025-20128 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy