CVE-2025-20234

Published Jun 18, 2025

Last updated 7 months ago

CVSS medium 5.3

Overview

Description: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .
Source: psirt@cisco.com
NVD status: Analyzed
Products: clamav, secure_endpoint, secure_endpoint_private_cloud

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

psirt@cisco.com: CWE-125

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "49480D41-EBD3-4541-8418-80DD6444C6DB",
            "versionEndExcluding": "1.4.3",
            "versionStartIncluding": "1.2.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*",
            "matchCriteriaId": "4F19C9AF-A336-4DF7-AB2A-778228F79A20",
            "versionEndExcluding": "1.26.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*",
            "matchCriteriaId": "DFA01B75-3D43-4B20-B5A7-354854025F96",
            "versionEndExcluding": "1.26.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
            "matchCriteriaId": "72687E9E-1CC5-44A2-B207-1E459FFECB56",
            "versionEndExcluding": "7.5.21",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*",
            "matchCriteriaId": "5389A975-75C0-47F7-9DE4-25FD91226785",
            "versionEndExcluding": "8.4.5",
            "versionStartIncluding": "8.0.1.21160",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7D78AF2-E32D-4346-A7A8-6137B623F1B8",
            "versionEndExcluding": "4.2.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References