PT-2026-7942 · Cisco · Clamav

Published 2020-07-22 · Updated 2026-02-27 · CVE-2020-37167

Positive Technologies · (AI Summary)

CVSS v3.1

10

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ClamAV versions prior to 0.102.0

Description The ClamAV ClamBC bytecode interpreter has a flaw in how it handles function names. This allows manipulation of bytecode function names due to weak input validation in function name encoding. Successful exploitation could lead to the execution of malicious bytecode or cause unpredictable behavior within the ClamAV engine.

Recommendations Update ClamAV to a version newer than 0.102.0.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-02545

CVE-2020-37167

Affected Products

Clamav

References · 18

• 🔥 https://exploit-db.com/exploits/47687 · Exploit
• https://github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-37167 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-37167 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-37167 · Security Note
• https://ubuntu.com/security/CVE-2020-37167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37167 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-37167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02545 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-37167 · Vendor Advisory
• https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.5.1 · Note
• https://vulncheck.com/advisories/clamav-clambc-clambc-executable-regular-expression-error · Note
• https://clamav.net · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-7942 · Note
• https://t.me/cveNotify/153544 · Telegram Post