Skip to content
OpenAdvisories
Critical USN-7615-1 2 CVEs

clamav vulnerabilities

Published Jul 2, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that ClamAV incorrectly handled scanning UDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2025-20234)

It was discovered that ClamAV incorrectly handled scanning PDF files. A
remote attacker could use this issue to cause ClamAV to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2025-20260)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS clamav 1.4.3+dfsg-0ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS clamav 1.4.3+dfsg-0ubuntu0.24.04.1

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-20260 Public exploit

    ClamAV PDF Scanning Buffer Overflow Vulnerability

    A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists…

    Cisco ClamAV clamav clamav Network devices Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2025-20234

    ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

    A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An…

    Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-20234
  • report
    https://ubuntu.com/security/CVE-2025-20260