CVE-2025-20234
published 2025-06-18CVE-2025-20234: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.66%
47.7th percentile
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.
For a description of this vulnerability, see the .
Affected
85 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
| cisco | cisco_secure_endpoint | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_cisco5.3MEDIUM
vendor_debian5.3LOW
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ClamAV vulnerabilities
vendor_ubuntu·2025-07-07·CVSS 5.3
CVE-2025-20260 [MEDIUM] ClamAV vulnerabilities
Title: ClamAV vulnerabilities
Summary: Several security issues were fixed in ClamAV.
USN-7615-1 fixed several vulnerabilities in ClamAV. This update provides
the corresponding update for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that ClamAV incorrectly handled scanning UDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A
remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2025-20260)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all th
Ubuntu
ClamAV vulnerabilities
vendor_ubuntu·2025-07-02·CVSS 5.3
CVE-2025-20260 [MEDIUM] ClamAV vulnerabilities
Title: ClamAV vulnerabilities
Summary: Several security issues were fixed in ClamAV.
It was discovered that ClamAV incorrectly handled scanning UDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A
remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2025-20260)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Cisco
ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
vendor_cisco·2025-06-18·CVSS 5.3
CVE-2025-20234 [MEDIUM] CWE-125 ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.
For a description of this vulnerability, see the ClamAV blog.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vu
Debian
CVE-2025-20234: clamav - A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow ...
vendor_debian·2025·CVSS 5.3
CVE-2025-20234 [MEDIUM] CVE-2025-20234: clamav - A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow ...
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 1.4.3+dfsg-1)
sid: resolved (fixed in 1.4.3+dfsg-1)
trixie: resolved (fixed in 1.4.3+dfsg-1)
Cisco
ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20234 ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
CVE-2025-20234: ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the ClamAV blog . Cisco has released software updates that address this vulnerability. There are
CVSS: 3.1
CWE: CWE
OSV
clamav vulnerabilities
osv·2025-07-07·CVSS 7.5
CVE-2025-20234 [HIGH] clamav vulnerabilities
clamav vulnerabilities
USN-7615-1 fixed several vulnerabilities in ClamAV. This update provides
the corresponding update for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that ClamAV incorrectly handled scanning UDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A
remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2025-20260)
OSV
clamav vulnerabilities
osv·2025-07-02·CVSS 7.5
CVE-2025-20234 [HIGH] clamav vulnerabilities
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled scanning UDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A
remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2025-20260)
OSV
CVE-2025-20234: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
osv·2025-06-18·CVSS 7.5
CVE-2025-20234 [HIGH] CVE-2025-20234: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .
GHSA
GHSA-xwph-f2wp-xxgp: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
ghsa_unreviewed·2025-06-18
CVE-2025-20234 [MEDIUM] CWE-125 GHSA-xwph-f2wp-xxgp: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.
For a description of this vulnerability, see the .
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-20234 squidclamav: ClamAV Information Disclosure Vulnerability [fedora-42]
bugzilla·2025-06-18·CVSS 7.5
CVE-2025-20234 [HIGH] CVE-2025-20234 squidclamav: ClamAV Information Disclosure Vulnerability [fedora-42]
CVE-2025-20234 squidclamav: ClamAV Information Disclosure Vulnerability [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2373722
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Pack
Wiz
CVE-2026-20031 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-20031 [HIGH] CVE-2026-20031 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-20031 :
Clam AntiVirus vulnerability analysis and mitigation
A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.
Source : NVD
## 5.3
Score
Published March 4, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Clam AntiVirus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Proba
Wiz
CVE-2020-37167 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2020-37167 [HIGH] CVE-2020-37167 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2020-37167 :
Clam AntiVirus vulnerability analysis and mitigation
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Source : NVD
## 8.6
Score
Published February 12, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Clam AntiVirus
Linux Ubuntu
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
clamav
2025-06-18
Published