A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.
For a description of this vulnerability, see the .
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cisco |
|
| Clamav |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
No data.
References
History
Wed, 06 Aug 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco secure Endpoint Cisco secure Endpoint Private Cloud Clamav Clamav clamav |
|
| CPEs | cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:* cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:* cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:* cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:* cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Cisco
Cisco secure Endpoint Cisco secure Endpoint Private Cloud Clamav Clamav clamav |
Tue, 18 Feb 2025 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-120 |
Wed, 22 Jan 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-120 | |
| Metrics |
ssvc
|
Wed, 22 Jan 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. | |
| Title | ClamAV OLE2 File Format Decryption Denial of Service Vulnerability | |
| Weaknesses | CWE-122 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2025-01-22T16:21:12.329Z
Updated: 2025-02-18T19:40:10.978Z
Reserved: 2024-10-10T19:15:13.212Z
Link: CVE-2025-20128
Vulnrichment
Updated: 2025-01-22T16:55:06.281Z
NVD
Status : Analyzed
Published: 2025-01-22T17:15:12.583
Modified: 2025-08-06T14:11:27.030
Link: CVE-2025-20128
Redhat
No data.