CVE-2025-20260

Published Jun 18, 2025

Last updated 14 days ago

ClamAV

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-20260 is a vulnerability found in ClamAV's PDF scanning functionality. It stems from incorrect memory buffer allocation during the processing of PDF files. Disclosed on June 18, 2025, this flaw affects all supported versions of ClamAV. An unauthenticated, remote attacker could exploit this vulnerability by submitting a specially crafted PDF file to be scanned. Successful exploitation could lead to a buffer overflow, potentially causing a denial-of-service (DoS) condition by crashing the antivirus engine. There is also a possibility of arbitrary code execution with the privileges of the ClamAV process. This is most likely to occur in configurations where the max file-size scan limit is set to greater than or equal to 1024MB and the max scan-size scan limit is set to greater than or equal to 1025MB.

Description: A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
Source: psirt@cisco.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@cisco.com: CWE-122

Hype score: Not currently trending

References