CVE-2025-20234 ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Medium 5.3 Published 18 Jun 2025 Updated 18 Jun 2025

An unauthenticated remote attacker can cause a denial of service by submitting a crafted UDF file to ClamAV, terminating the scanning process.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-20234?

CVE-2025-20234 is a medium-severity denial of service vulnerability in Clamav Clamav, published on 18 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

Weakness: CWE-125

Which versions are affected by CVE-2025-20234?

It affects 3 products.

Products include Cisco Secure Endpoint, Cisco Secure Endpoint Private Cloud, Clamav Clamav.

How do I fix CVE-2025-20234?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-20234 being exploited?

There is no known exploitation of CVE-2025-20234 in the wild and no public exploit code.

All Clamav Clamav vulnerabilities

Sources

Also known as DEBIAN-CVE-2025-20234, GHSA-xwph-f2wp-xxgp, MINI-pmv6-98rh-rwcf, UBUNTU-CVE-2025-20234.