Search for vulnerabilities
Vulnerability details: VCID-gaw6-a8vm-g3bd
Vulnerability ID VCID-gaw6-a8vm-g3bd
Aliases CVE-2025-20128
Summary A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-122 Heap-based Buffer Overflow
System Score Found at
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.00951 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02095 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02095 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
epss 0.02431 https://api.first.org/data/v1/epss?cve=CVE-2025-20128
cvssv3.1 5.3 https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
ssvc Track https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-20128
cvssv3.1 5.3 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
ssvc Track https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-20128
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20128
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1093880 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1093880
cisco-sa-clamav-ole2-H549rphA https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
clamav-142-and-108-security-patch.html https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*
cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*
CVE-2025-20128 https://nvd.nist.gov/vuln/detail/CVE-2025-20128
USN-7229-1 https://usn.ubuntu.com/7229-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-22T16:54:39Z/ Found at https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-20128
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-22T16:54:39Z/ Found at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
Exploit Prediction Scoring System (EPSS)
Percentile 0.7543
EPSS Score 0.00951
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:44:13.320320+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.22/community.json 37.0.0