CVE-2020-37167 ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
Attackers can exploit weak input validation in ClamAV bytecode interpreter to execute malicious bytecode or cause unexpected behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-37167?
CVE-2020-37167 is a high-severity code injection vulnerability in ClamAV ClamBC, published on 12 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Which versions are affected by CVE-2020-37167?
How do I fix CVE-2020-37167?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-37167 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37167 exists.
Sources
Also known as DEBIAN-CVE-2020-37167, GHSA-9wpq-3w4j-985q.