ClamAV vulnerabilities

5 known vulnerabilities in ClamAV from Cisco. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ClamAV: Heap-based Buffer Overflow

  CVE-2025-20260Jun 18, 2025CiscoEPSS 1.7%

  A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists

• 7.5 High severity

  ClamAV: Out-of-bounds Read

  CVE-2024-20505Sep 4, 2024Cisco

  A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthen

• 7.5 High severity

  ClamAV: Undefined Behavior for Input to API

  CVE-2024-20380Apr 18, 2024CiscoEPSS 1.1%

  A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could

• 7.5 High severity

  ClamAV: Double Free

  CVE-2022-20803Feb 17, 2023CiscoEPSS 1.06%

  A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the re

• 7.5 High severity

  ClamAV: Out-of-bounds Read

  CVE-2022-20698Jan 14, 2022CiscoEPSS 3.29%

  A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnera