Cisco ClamAV up to 1.4.2 PDF Scanning heap-based overflow

Summaryinfo

A vulnerability was found in Cisco ClamAV up to 1.4.2. It has been rated as critical. This issue affects some unknown processing of the component PDF Scanning. The manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2025-20260. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Cisco ClamAV up to 1.4.2. This issue affects an unknown function of the component PDF Scanning. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

The advisory is shared at blog.clamav.net. The identification of this vulnerability is CVE-2025-20260 since 10/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/07/2025).

The vulnerability scanner Nessus provides a plugin with the ID 240737 (SUSE SLES15 Security Update : clamav (SUSE-SU-2025:02119-1)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (240737), EUVD (EUVD-2025-18658) and CERT Bund (WID-SEC-2025-1362). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Open Source ClamAV
• Cisco Secure Endpoint
• cPanel cPanel/WHM

Productinfo

Type

• Anti-Malware Software

Vendor

• Cisco

Name

• ClamAV

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.3.0
• 1.3.1
• 1.3.2
• 1.4.0
• 1.4.1
• 1.4.2

License

• free

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion