CVE-2025-20234: clamav +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-20234

CVSS 7.5 · High EPSS 0,82%

Kerentanan Out-of-bounds Read pada clamav, cisco secure endpoint +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

Rincian

Terbit di NVD: 18 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-125: Out-of-bounds Read
EPSS (30 hari): 0,82% peluang dieksploitasi; lebih tinggi dari 55,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
clamav	clamav	Versi 1.2.0 hingga sebelum 1.4.3
cisco	secure endpoint	Semua versi sebelum 1.26.1
cisco	secure endpoint	Semua versi sebelum 7.5.21
cisco	secure endpoint	Versi 8.0.1.21160 hingga sebelum 8.4.5
cisco	secure endpoint private cloud	Semua versi sebelum 4.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html advisory vendor
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.