A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1081 advisory.

    A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote     attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to a     memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a     crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the     affected software.For a description of this vulnerability, see the . (CVE-2025-20234)

    A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to     cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on     an affected device.This vulnerability exists because memory buffers are allocated incorrectly when PDF     files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer     overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the     affected software. Although unproven, there is also a possibility that an attacker could leverage the     buffer overflow to execute arbitrary code with the privileges of the ClamAV process. (CVE-2025-20260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its version, the ClamAV clamd antivirus daemon running on the remote host is 0.99.4 prior to 1.0.9, 1.2.0 prior to 1.4.3. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability     is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by     submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a     DoS condition on the affected software. (CVE-2025-20234)

  - A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker     to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary     code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly     when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF     file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to     trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS     condition on the affected software. Although unproven, there is also a possibility that an attacker could     leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.     (CVE-2025-20260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7615-1 advisory.

    It was discovered that ClamAV incorrectly handled scanning UDF files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2025-20234)

    It was discovered that ClamAV incorrectly handled scanning PDF files. A remote attacker could use this     issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2025-20260)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02200-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02201-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

    Other bugfixes:

    - Fix a race condition between the mockup servers started by different test cases in freshclam_test.py     (bsc#1243565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Secure Endpoint Connector for ClamAV is affected by a vulnerability.

  - A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote     attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to     a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a     crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the     affected software. (CVE-2025-20234)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02119-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

    Other bugfixes:

    - Fix a race condition between the mockup servers started by different test cases in freshclam_test.py     (bsc#1243565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-88b0ad0c1f advisory.

    Latest release.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6c6c1507-4da5-11f0-afcc-f02f7432cf97 advisory.

    Cisco reports:
    A vulnerability in Universal Disk Format (UDF) processing of ClamAV             could allow an unauthenticated, remote attacker to cause a denial             of service (DoS) condition on an affected device.

            This vulnerability is due to a memory overread during UDF file             scanning.  An attacker could exploit this vulnerability by submitting             a crafted file containing UDF content to be scanned by ClamAV on             an affected device.  A successful exploit could allow the attacker             to terminate the ClamAV scanning process, resulting in a DoS condition             on the affected software.  For a description of this vulnerability,             see the .

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ac841fe82 advisory.

    1.4.3


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241789	Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2025-1081)	Nessus	Amazon Linux Local Security Checks	critical
241516	ClamAV 0.99.4 < 1.0.9, 1.2.0 < 1.4.3 Multiple Vulnerabilities	Nessus	Misc.	critical
241349	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : ClamAV vulnerabilities (USN-7615-1)	Nessus	Ubuntu Local Security Checks	critical
241235	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2025:02200-1)	Nessus	SuSE Local Security Checks	critical
241228	SUSE SLES12 Security Update : clamav (SUSE-SU-2025:02201-1)	Nessus	SuSE Local Security Checks	critical
240744	Cisco Secure Endpoint ClamAV DoS (cisco-sa-clamav-udf-hmwd9nDy)	Nessus	CISCO	medium
240737	SUSE SLES15 Security Update : clamav (SUSE-SU-2025:02119-1)	Nessus	SuSE Local Security Checks	critical
240727	Fedora 41 : clamav (2025-88b0ad0c1f)	Nessus	Fedora Local Security Checks	critical
240229	FreeBSD : clamav -- ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (6c6c1507-4da5-11f0-afcc-f02f7432cf97)	Nessus	FreeBSD Local Security Checks	medium
240223	Fedora 42 : clamav (2025-2ac841fe82)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2025-20234

medium

Tenable Plugins

critical

critical

critical

critical

critical

medium

critical

critical

medium

critical