CVE-2025-20234

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-20234
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*
History

11 Aug 2025, 18:24

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*
First Time Clamav
Cisco
Cisco secure Endpoint
Cisco secure Endpoint Private Cloud
Clamav clamav
References () https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html - () https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html - Vendor Advisory
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy - Third Party Advisory

23 Jun 2025, 20:16

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en el procesamiento de Universal Disk Format (UDF) de ClamAV podría permitir que un atacante remoto no autenticado provoque una denegación de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad se debe a una sobrelectura de memoria durante el análisis de archivos UDF. Un atacante podría explotar esta vulnerabilidad enviando un archivo manipulado con contenido UDF para que ClamAV lo analice en un dispositivo afectado. Una explotación exitosa podría permitir al atacante finalizar el proceso de análisis de ClamAV, lo que provocaría una denegación de servicio (DoS) en el software afectado. Para obtener una descripción de esta vulnerabilidad, consulte [enlace faltante].

18 Jun 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 17:15

Updated : 2025-08-11 18:24

NVD link : CVE-2025-20234

Mitre link : CVE-2025-20234

CVE.ORG link : CVE-2025-20234

JSON object : View

Products Affected

cisco

  • secure_endpoint_private_cloud
  • secure_endpoint

clamav

  • clamav
CWE
CWE-125

Out-of-bounds Read