A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

The version of clamav installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-20260 advisory.

  - A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to     cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on     an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF     files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer     overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the     affected software. Although unproven, there is also a possibility that an attacker could leverage the     buffer overflow to execute arbitrary code with the privileges of the ClamAV process. (CVE-2025-20260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of clamav installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-20260 advisory.

  - A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to     cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on     an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF     files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer     overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the     affected software. Although unproven, there is also a possibility that an attacker could leverage the     buffer overflow to execute arbitrary code with the privileges of the ClamAV process. (CVE-2025-20260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1081 advisory.

    A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote     attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to a     memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a     crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit     could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the     affected software.For a description of this vulnerability, see the . (CVE-2025-20234)

    A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to     cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on     an affected device.This vulnerability exists because memory buffers are allocated incorrectly when PDF     files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer     overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the     affected software. Although unproven, there is also a possibility that an attacker could leverage the     buffer overflow to execute arbitrary code with the privileges of the ClamAV process. (CVE-2025-20260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its version, the ClamAV clamd antivirus daemon running on the remote host is 0.99.4 prior to 1.0.9, 1.2.0 prior to 1.4.3. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated,     remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability     is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by     submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a     DoS condition on the affected software. (CVE-2025-20234)

  - A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker     to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary     code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly     when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF     file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to     trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS     condition on the affected software. Although unproven, there is also a possibility that an attacker could     leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.     (CVE-2025-20260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7615-1 advisory.

    It was discovered that ClamAV incorrectly handled scanning UDF files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2025-20234)

    It was discovered that ClamAV incorrectly handled scanning PDF files. A remote attacker could use this     issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2025-20260)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02200-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02201-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

    Other bugfixes:

    - Fix a race condition between the mockup servers started by different test cases in freshclam_test.py     (bsc#1243565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02119-1 advisory.

    ClamAV version 1.4.3:

    - CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
    - CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).

    Other bugfixes:

    - Fix a race condition between the mockup servers started by different test cases in freshclam_test.py     (bsc#1243565)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-88b0ad0c1f advisory.

    Latest release.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3dcc0812-4da5-11f0-afcc-f02f7432cf97 advisory.

    Cisco reports:
    A vulnerability in the PDF scanning processes of ClamAV could allow             an unauthenticated, remote attacker to cause a buffer overflow             condition, cause a denial of service (DoS) condition, or execute             arbitrary code on an affected device.

            This vulnerability exists because memory buffers are allocated             incorrectly when PDF files are processed.  An attacker could exploit             this vulnerability by submitting a crafted PDF file to be scanned             by ClamAV on an affected device.  A successful exploit could allow             the attacker to trigger a buffer overflow, likely resulting in the             termination of the ClamAV scanning process and a DoS condition on             the affected software.  Although unproven, there is also a possibility             that an attacker could leverage the buffer overflow to execute             arbitrary code with the privileges of the ClamAV process.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ac841fe82 advisory.

    1.4.3


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241952	Azure Linux 3.0 Security Update: clamav (CVE-2025-20260)	Nessus	Azure Linux Local Security Checks	critical
241942	CBL Mariner 2.0 Security Update: clamav (CVE-2025-20260)	Nessus	MarinerOS Local Security Checks	critical
241789	Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2025-1081)	Nessus	Amazon Linux Local Security Checks	critical
241516	ClamAV 0.99.4 < 1.0.9, 1.2.0 < 1.4.3 Multiple Vulnerabilities	Nessus	Misc.	critical
241349	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : ClamAV vulnerabilities (USN-7615-1)	Nessus	Ubuntu Local Security Checks	critical
241235	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2025:02200-1)	Nessus	SuSE Local Security Checks	critical
241228	SUSE SLES12 Security Update : clamav (SUSE-SU-2025:02201-1)	Nessus	SuSE Local Security Checks	critical
240737	SUSE SLES15 Security Update : clamav (SUSE-SU-2025:02119-1)	Nessus	SuSE Local Security Checks	critical
240727	Fedora 41 : clamav (2025-88b0ad0c1f)	Nessus	Fedora Local Security Checks	critical
240230	FreeBSD : clamav -- ClamAV PDF Scanning Buffer Overflow Vulnerability (3dcc0812-4da5-11f0-afcc-f02f7432cf97)	Nessus	FreeBSD Local Security Checks	critical
240223	Fedora 42 : clamav (2025-2ac841fe82)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2025-20260

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical