CVE-2025-20128 ClamAV OLE2 File Format Decryption Denial of Service Vulnerability
An unauthenticated remote attacker can cause a denial of service in ClamAV by submitting a crafted OLE2 file, triggering an integer underflow and heap buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-20128?
CVE-2025-20128 is a medium-severity vulnerability in Clamav Clamav, published on 22 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Weakness: CWE-122
Which versions are affected by CVE-2025-20128?
It affects 3 products.
Products include Cisco Secure Endpoint, Cisco Secure Endpoint Private Cloud, Clamav Clamav.
How do I fix CVE-2025-20128?
Upgrade to a fixed version.
Is CVE-2025-20128 being exploited?
There is no known exploitation of CVE-2025-20128 in the wild and no public exploit code.
Other vulnerabilities in Clamav Clamav
- CVE-2023-20032 Memory corruption in Cisco Secure Endpoint
- CVE-2022-20770 ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022
- CVE-2026-20348 ClamAV XAR File Format Processing Memory Corruption Vulnerability
- CVE-2026-20213 ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability
- CVE-2026-20214 ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability
Sources
Also known as DEBIAN-CVE-2025-20128, GHSA-6j5q-p9xp-3cc6, MGASA-2025-0031, MINI-vw9h-p9p6-6fv6, UBUNTU-CVE-2025-20128, USN-7229-1.