PT-2025-1255 · Clamav+4 · Clamav+4

Published 2025-01-22 · Updated 2026-02-10 · CVE-2025-20128

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ClamAV versions 1.0.0 through 1.4.1

Description: A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Recommendations: ClamAV versions 1.0.0 through 1.4.1 should be updated to version 1.4.2 or later to address the vulnerability. ClamAV version 1.0.8 or earlier should be updated to version 1.0.8 or later, however, it is recommended to update to the latest version available.

Fix

DoS

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-120

Related Identifiers

BDU:2025-00660

CVE-2025-20128

DLA-4292-1

MGASA-2025-0031

OPENSUSE-SU-2025:14683-1

OPENSUSE-SU-2025_0327-1

SUSE-SU-2025:0325-1

SUSE-SU-2025:0327-1

SUSE-SU-2025:0328-1

USN-7229-1

Affected Products

Clamav

Debian

Linuxmint

Suse

Ubuntu

References · 58

• https://advisories.mageia.org/MGASA-2025-0031.html · Security Note
• https://ubuntu.com/security/CVE-2025-20128 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4292-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20128 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7229-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0327-1 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA · Vendor Advisory
• https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-7229-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14683-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0031 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0325-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-20128 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-20128 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-20128 · Security Note