Every CVE Search/ Get API key

CVE-2024-20328

ClamAV VirusEvent File Processing Command Injection Vulnerability

5.3 MediumFix available

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

84.8%Up 84.8 points since Mar 2, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

ClamAV VirusEvent File Processing Command Injection Vulnerability

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2024-18043 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
EUVD-2024-18043
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-vhq6-cjc8-x8v9 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject...

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
GHSA-vhq6-cjc8-x8v9
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-78
Updated
2026-11-02
NVD 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-78
Updated
2026-11-02
OSVALPINE-CVE-2024-20328 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
ALPINE-CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
OSV 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2024-20328 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
DEBIAN-CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-20328 5.3

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
UBUNTU-CVE-2024-20328
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-35428 No score

CVE-2024-20328 affecting package clamav for versions less than 0.105.2-5

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
AZL-35428
Updated
2026-11-02
OSVAZL-35431 No score

CVE-2024-20328 affecting package clamav for versions less than 1.0.6-1

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Record
AZL-35431
Updated
2026-11-02
OSVCLSA-2025-1756923561 No score

clamav: Fix of 8 CVEs

  • Update to 1.0.9 LTS version
  • CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
  • CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
  • CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files
  • CVE-2024-20290: Fixed a possible heap overflow read bug in the OLE2 file parser
  • CVE-2024-20328: Fixed a possible command injection in the 'VirusEvent' feature of the clamd service
  • CVE-2023-20197: Fixed a possible denial of service in the HFS+ parser
  • CVE-2023-20212: Fixed a possible DoS in the AutoIT file parser
  • CVE-2023-20052: Fixed a possible remote information leak in the DMG file parser
Record
CLSA-2025-1756923561
Updated
2026-11-02
OSVMGASA-2024-0048 No score

Updated clamav packages fix security vulnerabilities

The updated packages fix security vulnerabilities: A possible heap overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition. (CVE-2024-20290) A possible command injection vulnerability in the "VirusEvent" feature of ClamAV's ClamD service. (CVE-2024-20328)

Record
MGASA-2024-0048
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
clamav
Alpine:v3.19
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Alpine:v3.20
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Alpine:v3.21
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Alpine:v3.22
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Alpine:v3.23
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Alpine:v3.24
 1.0.0 up to 1.2.2-r0
1.2.2-r0
clamav
Azure Linux:2
 before 0.105.2-5
0.105.2-5
clamav
Azure Linux:3
 before 1.0.6-1
1.0.6-1
clamav
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-data
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
clamav-devel
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-doc
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-filesystem
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-freshclam
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-lib
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav-milter
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamd
TuxCare:CentOS:6
From an advisory covering 8 CVEs
 before 1.0.9-1.el6.tuxcare.els1
1.0.9-1.el6.tuxcare.els1
clamav
Debian:12
 before 1.0.5+dfsg-1~deb12u1, plus listed versions
1.0.1+dfsg-21.0.2+dfsg-11.0.2+dfsg-1~deb12u11.0.3+dfsg-11.0.3+dfsg-1~deb12u11.0.3+dfsg-21.0.4+dfsg-1
1.0.5+dfsg-1~deb12u1
clamav
Debian:13
 before 1.0.5+dfsg-1
1.0.5+dfsg-1
clamav
Debian:14
 before 1.0.5+dfsg-1
1.0.5+dfsg-1
clamav
Mageia:9
From an advisory covering 2 CVEs
 before 1.0.5-1.mga9
1.0.5-1.mga9
clamav
Ubuntu:24.04:LTS
 before 1.0.5+dfsg-1ubuntu1, plus listed versions
1.0.2+dfsg-1ubuntu11.0.3+dfsg-2ubuntu11.0.4+dfsg-0ubuntu1
1.0.5+dfsg-1ubuntu1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-20328 is a medium vulnerability (CVSS 5.3) in Cisco Clamav, published February 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 84.8%, the 99th percentile. Fixed in clamav 1.2.2-r0.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open