CVE-2025-20260
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-06-18

Last updated on: 2025-11-03

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-18
Last Modified
2025-11-03
Generated
2026-05-07
AI Q&A
2025-06-18
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
clamav clamav to 1.0.9 (exc)
clamav clamav From 1.2.0 (inc) to 1.4.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is in the PDF scanning process of ClamAV, where incorrect memory buffer allocation when processing PDF files can be exploited by an unauthenticated remote attacker. By submitting a specially crafted PDF file, the attacker can cause a buffer overflow, potentially leading to the termination of the ClamAV scanning process (denial of service) or possibly executing arbitrary code with the privileges of the ClamAV process.


How can this vulnerability impact me? :

If exploited, this vulnerability can cause a denial of service by crashing the ClamAV scanning process, disrupting malware scanning operations. Additionally, there is a risk that an attacker could execute arbitrary code on the affected device with the same privileges as ClamAV, potentially leading to further compromise of the system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart