CVE-2025-20260
ClamAV PDF Scanning Buffer Overflow Vulnerability
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ClamAV PDF Scanning Buffer Overflow Vulnerability
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-03
EUVDEUVD-2025-18658
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
EUVD-2025-18658- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-596c-w2jc-jmmx
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote...
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
GHSA-596c-w2jc-jmmx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-20260
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
ALPINE-CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 19 moreShow less
OSVDEBIAN-CVE-2025-20260
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
DEBIAN-CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1693
clamav security update
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
Security Fix(es):
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.(CVE-2025-20260)
- Record
OESA-2025-1693- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1694
clamav security update
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
Security Fix(es):
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.(CVE-2025-20260)
- Record
OESA-2025-1694- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1695
clamav security update
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
Security Fix(es):
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.(CVE-2025-20260)
- Record
OESA-2025-1695- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1696
clamav security update
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
Security Fix(es):
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.(CVE-2025-20260)
- Record
OESA-2025-1696- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1763
clamav security update
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
Security Fix(es):
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.(CVE-2025-20260)
- Record
OESA-2025-1763- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-20260
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
UBUNTU-CVE-2025-20260- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-64208 No score
CVE-2025-20260 affecting package clamav for versions less than 1.0.9-1
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
AZL-64208- Updated
- 2026-11-02
OSVAZL-64223 No score
CVE-2025-20260 affecting package clamav for versions less than 1.0.9-1
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.
This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
- Record
AZL-64223- Updated
- 2026-11-02
OSVCLSA-2025-1756202550 No score
Fix of 9 CVEs
- Update up to 1.4.3 LTS
- CVE-2025-20260
- CVE-2025-20234
- CVE-2025-20128
- CVE-2024-20505, CVE-2024-20506
- CVE-2023-20197
- CVE-2023-20212
- CVE-2023-20032
- CVE-2023-20052
- Record
CLSA-2025-1756202550- Updated
- 2026-11-02
OSVCLSA-2025-1756409595 No score
clamav: Fix of 4 CVEs
- Update to 1.4.3 LTS
- CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
- CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser
- CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
- CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files
- Record
CLSA-2025-1756409595- Updated
- 2026-11-02
OSVCLSA-2025-1756923561 No score
clamav: Fix of 8 CVEs
- Update to 1.0.9 LTS version
- CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser
- CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser
- CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files
- CVE-2024-20290: Fixed a possible heap overflow read bug in the OLE2 file parser
- CVE-2024-20328: Fixed a possible command injection in the 'VirusEvent' feature of the clamd service
- CVE-2023-20197: Fixed a possible denial of service in the HFS+ parser
- CVE-2023-20212: Fixed a possible DoS in the AutoIT file parser
- CVE-2023-20052: Fixed a possible remote information leak in the DMG file parser
- Record
CLSA-2025-1756923561- Updated
- 2026-11-02
OSVMGASA-2025-0190 No score
Updated clamav packages fix security vulnerability
Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution. (CVE-2025-20260)
- Record
MGASA-2025-0190- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15211-1 No score
clamav-1.4.3-1.1 on GA media
These are all security issues fixed in the clamav-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15211-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02119-1 No score
Security update for clamav
This update for clamav fixes the following issues:
ClamAV version 1.4.3:
- CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
- CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).
Other bugfixes:
- Fix a race condition between the mockup servers started by different test cases in freshclam_test.py (bsc#1243565)
- Record
SUSE-SU-2025:02119-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02200-1 No score
Security update for clamav
This update for clamav fixes the following issues:
ClamAV version 1.4.3:
- CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
- CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).
- Record
SUSE-SU-2025:02200-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02201-1 No score
Security update for clamav
This update for clamav fixes the following issues:
ClamAV version 1.4.3:
- CVE-2025-20260: PDF Scanning Buffer Overflow Vulnerability (bsc#1245054).
- CVE-2025-20234: Vulnerability in Universal Disk Format (UDF) processing (bsc#1245055).
Other bugfixes:
- Fix a race condition between the mockup servers started by different test cases in freshclam_test.py (bsc#1243565)
- Record
SUSE-SU-2025:02201-1- Updated
- 2026-11-02
OSVUSN-7615-1 No score
clamav vulnerabilities
It was discovered that ClamAV incorrectly handled scanning UDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-20260)
- Record
USN-7615-1- Updated
- 2026-11-02
OSVUSN-7615-2 No score
clamav vulnerabilities
USN-7615-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that ClamAV incorrectly handled scanning UDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2025-20234)
It was discovered that ClamAV incorrectly handled scanning PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-20260)
- Record
USN-7615-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clamavAlpine:v3.22 |
1.2.0 up to 1.4.3-r0 | 1.4.3-r0 |
clamavAlpine:v3.23 |
1.2.0 up to 1.4.3-r0 | 1.4.3-r0 |
clamavAlpine:v3.24 |
1.2.0 up to 1.4.3-r0 | 1.4.3-r0 |
clamavAzure Linux:2 |
before 1.0.9-1 | 1.0.9-1 |
clamavAzure Linux:3 |
before 1.0.9-1 | 1.0.9-1 |
clamavTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-baseTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-daemonTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-docTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-docsTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
Show 65 moreShow less
| Package | Affected | Fixed |
|---|---|---|
clamav-freshclamTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-milterTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamav-testfilesTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamdscanTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
libclamav-devTuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
libclamav12TuxCare:Ubuntu:18.04 From an advisory covering 9 CVEs |
before 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 | 1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els1 |
clamavTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-dataTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-develTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-docTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-filesystemTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-freshclamTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-libTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamav-milterTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamdTuxCare:CentOS:7 From an advisory covering 4 CVEs |
before 1:1.4.3-1.el7.tuxcare.els1 | 1:1.4.3-1.el7.tuxcare.els1 |
clamavTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-dataTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-develTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-docTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-filesystemTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-freshclamTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-libTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamav-milterTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamdTuxCare:CentOS:6 From an advisory covering 8 CVEs |
before 1.0.9-1.el6.tuxcare.els1 | 1.0.9-1.el6.tuxcare.els1 |
clamavDebian:12 |
before 1.0.9+dfsg-1~deb12u1, plus listed versions 1.0.1+dfsg-21.0.2+dfsg-11.0.2+dfsg-1~deb12u11.0.3+dfsg-11.0.3+dfsg-1~deb12u1 Show 10 moreShow less1.0.3+dfsg-21.0.4+dfsg-11.0.5+dfsg-11.0.5+dfsg-1.11.0.5+dfsg-1~deb12u11.0.6+dfsg-11.0.7+dfsg-1~deb11u11.0.7+dfsg-1~deb11u21.0.7+dfsg-1~deb12u11.0.9+dfsg-1~deb11u1 |
1.0.9+dfsg-1~deb12u1 |
clamavDebian:13 |
before 1.4.3+dfsg-1 | 1.4.3+dfsg-1 |
clamavDebian:14 |
before 1.4.3+dfsg-1 | 1.4.3+dfsg-1 |
clamavDebian:11 From an advisory covering 2 CVEs |
before 1.0.9+dfsg-1~deb11u1, plus listed versions 0.103.10+dfsg-0+deb11u10.103.2+dfsg-20.103.3+dfsg-0+deb11u10.103.3+dfsg-10.103.4+dfsg-0+deb11u1 Show 30 moreShow less0.103.4+dfsg-10.103.5+dfsg-0+deb11u10.103.5+dfsg-10.103.6+dfsg-0+deb11u10.103.6+dfsg-10.103.7+dfsg-0+deb11u10.103.7+dfsg-10.103.8+dfsg-0+deb11u10.103.9+dfsg-0+deb11u11.0.0+dfsg-11.0.0+dfsg-21.0.0+dfsg-31.0.0+dfsg-41.0.0+dfsg-51.0.0+dfsg-61.0.1+dfsg-11.0.1+dfsg-21.0.2+dfsg-11.0.2+dfsg-1~deb12u11.0.3+dfsg-11.0.3+dfsg-1~deb12u11.0.3+dfsg-21.0.4+dfsg-11.0.5+dfsg-11.0.5+dfsg-1.11.0.5+dfsg-1~deb12u11.0.6+dfsg-11.0.7+dfsg-1~deb11u11.0.7+dfsg-1~deb11u21.0.7+dfsg-1~deb12u1 |
1.0.9+dfsg-1~deb11u1 |
clamavMageia:9 |
before 1.0.9-1.mga9 | 1.0.9-1.mga9 |
clamavopenEuler:22.03-LTS-SP4 |
before 1.0.9-2.oe2203sp4 | 1.0.9-2.oe2203sp4 |
clamavopenEuler:24.03-LTS |
before 1.0.9-2.oe2403 | 1.0.9-2.oe2403 |
clamavopenEuler:24.03-LTS-SP1 |
before 1.0.9-2.oe2403sp1 | 1.0.9-2.oe2403sp1 |
clamavopenEuler:22.03-LTS-SP3 |
before 1.0.9-2.oe2203sp3 | 1.0.9-2.oe2203sp3 |
clamavopenEuler:24.03-LTS-SP2 |
before 1.0.9-2.oe2403sp2 | 1.0.9-2.oe2403sp2 |
clamavSUSE:Linux Enterprise Micro 5.5 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Manager Proxy 4.3 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Manager Server 4.3 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Enterprise Storage 7.1 From an advisory covering 2 CVEs |
before 1.4.3-150200.8.14.1 | 1.4.3-150200.8.14.1 |
clamavSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 1.4.3-150600.18.18.1 | 1.4.3-150600.18.18.1 |
clamavSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 2 CVEs |
before 1.4.3-150600.18.18.1 | 1.4.3-150600.18.18.1 |
clamavopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.4.3-150600.18.18.1 | 1.4.3-150600.18.18.1 |
clamavSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 2 CVEs |
before 1.4.3-3.47.1 | 1.4.3-3.47.1 |
clamavSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs |
before 1.4.3-3.47.1 | 1.4.3-3.47.1 |
clamavUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.97.8+dfsg-1ubuntu40.97.8+dfsg-1ubuntu50.98.1+dfsg-1ubuntu40.98.1+dfsg-1ubuntu50.98.1+dfsg-2ubuntu2 Show 28 moreShow less0.98.1+dfsg-4ubuntu10.98.1+dfsg-4ubuntu1.10.98.5+addedllvm-0ubuntu0.14.04.10.98.6+dfsg-0ubuntu0.14.04.10.98.7+dfsg-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.10.99.2+addedllvm-0ubuntu0.14.04.20.99.3+addedllvm-0ubuntu0.14.04.10.99.4+addedllvm-0ubuntu0.14.04.10.100.1+dfsg-1ubuntu0.14.04.10.100.1+dfsg-1ubuntu0.14.04.20.100.1+dfsg-1ubuntu0.14.04.30.100.1+dfsg-1ubuntu0.14.04.40.100.2+dfsg-1ubuntu0.14.04.10.100.2+dfsg-1ubuntu0.14.04.20.100.3+dfsg-0ubuntu0.14.04.10.100.3+dfsg-0ubuntu0.14.04.1+esm10.101.4+dfsg-0ubuntu0.14.04.1+esm10.102.1+dfsg-0ubuntu0.14.04.1+esm10.102.2+dfsg-0ubuntu0.14.04.1+esm10.102.3+dfsg-0ubuntu0.14.04.1+esm10.102.4+dfsg-0ubuntu0.14.04.1+esm10.103.2+dfsg-0ubuntu0.14.04.1+esm10.103.2+dfsg-0ubuntu0.14.04.1+esm20.103.5+dfsg-0ubuntu0.14.04.1+esm10.103.6+dfsg-0ubuntu0.14.04.1+esm10.103.8+dfsg-0ubuntu0.14.04.1+esm10.103.9+dfsg-0ubuntu0.14.04.1+esm1 |
None known |
clamavUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.98.7+dfsg-0ubuntu40.98.7+dfsg-0ubuntu50.99+dfsg-1ubuntu10.99+dfsg-1ubuntu1.10.99+dfsg-1ubuntu1.2 Show 22 moreShow less0.99.2+dfsg-0ubuntu0.16.04.10.99.2+dfsg-0ubuntu0.16.04.20.99.2+dfsg-0ubuntu0.16.04.30.99.3+addedllvm-0ubuntu0.16.04.10.99.4+addedllvm-0ubuntu0.16.04.10.100.1+dfsg-1ubuntu0.16.04.10.100.1+dfsg-1ubuntu0.16.04.20.100.1+dfsg-1ubuntu0.16.04.30.100.2+dfsg-1ubuntu0.16.04.10.100.3+dfsg-0ubuntu0.16.04.10.101.4+dfsg-0ubuntu0.16.04.10.102.1+dfsg-0ubuntu0.16.04.20.102.2+dfsg-0ubuntu0.16.04.10.102.3+dfsg-0ubuntu0.16.04.10.102.4+dfsg-0ubuntu0.16.04.10.103.2+dfsg-0ubuntu0.16.04.10.103.2+dfsg-0ubuntu0.16.04.1+esm10.103.5+dfsg-0ubuntu0.16.04.1+esm10.103.6+dfsg-0ubuntu0.16.04.1+esm10.103.8+dfsg-0ubuntu0.16.04.1+esm10.103.9+dfsg-0ubuntu0.16.04.1+esm10.103.12+dfsg-0ubuntu0.16.04.1+esm1 |
None known |
clamavUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.99.2+dfsg-6ubuntu20.99.3~beta1+dfsg-2ubuntu10.99.3~beta1+dfsg-2ubuntu20.99.3+addedllvm-0ubuntu10.99.3+addedllvm-0ubuntu2 Show 19 moreShow less0.99.4+addedllvm-0ubuntu10.100.1+dfsg-1ubuntu0.18.04.10.100.1+dfsg-1ubuntu0.18.04.20.100.1+dfsg-1ubuntu0.18.04.30.100.2+dfsg-1ubuntu0.18.04.10.100.3+dfsg-0ubuntu0.18.04.10.101.4+dfsg-0ubuntu0.18.04.10.102.1+dfsg-0ubuntu0.18.04.20.102.2+dfsg-0ubuntu0.18.04.10.102.3+dfsg-0ubuntu0.18.04.10.102.4+dfsg-0ubuntu0.18.04.10.103.2+dfsg-0ubuntu0.18.04.10.103.2+dfsg-0ubuntu0.18.04.20.103.2+dfsg-0ubuntu0.18.04.30.103.5+dfsg-0ubuntu0.18.04.10.103.6+dfsg-0ubuntu0.18.04.10.103.8+dfsg-0ubuntu0.18.04.10.103.9+dfsg-0ubuntu0.18.04.1+esm10.103.12+dfsg-0ubuntu0.18.04.1+esm1 |
None known |
clamavUbuntu:Pro:20.04:LTS |
before 1.4.3+dfsg-0ubuntu0.20.04.1+esm1, plus listed versions 0.101.4+dfsg-1ubuntu10.102.1+dfsg-1ubuntu10.102.1+dfsg-2ubuntu10.102.1+dfsg-2ubuntu20.102.2+dfsg-1ubuntu1 Show 11 moreShow less0.102.2+dfsg-2ubuntu10.102.3+dfsg-0ubuntu0.20.04.10.102.4+dfsg-0ubuntu0.20.04.10.103.2+dfsg-0ubuntu0.20.04.10.103.2+dfsg-0ubuntu0.20.04.20.103.5+dfsg-1~20.04.10.103.6+dfsg-0ubuntu0.20.04.10.103.8+dfsg-0ubuntu0.20.04.10.103.9+dfsg-0ubuntu0.20.04.10.103.11+dfsg-0ubuntu0.20.04.10.103.12+dfsg-0ubuntu0.20.04.1 |
1.4.3+dfsg-0ubuntu0.20.04.1+esm1 |
clamavUbuntu:22.04:LTS |
before 1.4.3+dfsg-0ubuntu0.22.04.1, plus listed versions 0.103.3+dfsg-10.103.4+dfsg-10.103.4+dfsg-1build10.103.5+dfsg-10.103.6+dfsg-0ubuntu0.22.04.1 Show 4 moreShow less0.103.8+dfsg-0ubuntu0.22.04.10.103.9+dfsg-0ubuntu0.22.04.10.103.11+dfsg-0ubuntu0.22.04.10.103.12+dfsg-0ubuntu0.22.04.1 |
1.4.3+dfsg-0ubuntu0.22.04.1 |
clamavUbuntu:24.04:LTS |
before 1.4.3+dfsg-0ubuntu0.24.04.1, plus listed versions 1.0.2+dfsg-1ubuntu11.0.3+dfsg-2ubuntu11.0.4+dfsg-0ubuntu11.0.5+dfsg-1ubuntu11.0.5+dfsg-1.1ubuntu21.0.5+dfsg-1.1ubuntu31.0.7+dfsg-0ubuntu0.24.04.11.0.8+dfsg-0ubuntu0.24.04.1 |
1.4.3+dfsg-0ubuntu0.24.04.1 |
clamavUbuntu:25.10 |
before 1.4.3+dfsg-0ubuntu1, plus listed versions 1.4.2+dfsg-0ubuntu11.4.2+dfsg-0ubuntu21.4.2+dfsg-1ubuntu1 |
1.4.3+dfsg-0ubuntu1 |
clamavUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 1.4.3+dfsg-0ubuntu0.22.04.1, plus listed versions 0.103.3+dfsg-10.103.4+dfsg-10.103.4+dfsg-1build10.103.5+dfsg-10.103.6+dfsg-0ubuntu0.22.04.1 Show 4 moreShow less0.103.8+dfsg-0ubuntu0.22.04.10.103.9+dfsg-0ubuntu0.22.04.10.103.11+dfsg-0ubuntu0.22.04.10.103.12+dfsg-0ubuntu0.22.04.1 |
1.4.3+dfsg-0ubuntu0.22.04.1 |
clamavUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 1.4.3+dfsg-0ubuntu0.24.04.1, plus listed versions 1.0.2+dfsg-1ubuntu11.0.3+dfsg-2ubuntu11.0.4+dfsg-0ubuntu11.0.5+dfsg-1ubuntu11.0.5+dfsg-1.1ubuntu21.0.5+dfsg-1.1ubuntu31.0.7+dfsg-0ubuntu0.24.04.11.0.8+dfsg-0ubuntu0.24.04.1 |
1.4.3+dfsg-0ubuntu0.24.04.1 |
clamavUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 1.4.3+dfsg-0ubuntu0.20.04.1+esm1, plus listed versions 0.101.4+dfsg-1ubuntu10.102.1+dfsg-1ubuntu10.102.1+dfsg-2ubuntu10.102.1+dfsg-2ubuntu20.102.2+dfsg-1ubuntu1 Show 11 moreShow less0.102.2+dfsg-2ubuntu10.102.3+dfsg-0ubuntu0.20.04.10.102.4+dfsg-0ubuntu0.20.04.10.103.2+dfsg-0ubuntu0.20.04.10.103.2+dfsg-0ubuntu0.20.04.20.103.5+dfsg-1~20.04.10.103.6+dfsg-0ubuntu0.20.04.10.103.8+dfsg-0ubuntu0.20.04.10.103.9+dfsg-0ubuntu0.20.04.10.103.11+dfsg-0ubuntu0.20.04.10.103.12+dfsg-0ubuntu0.20.04.1 |
1.4.3+dfsg-0ubuntu0.20.04.1+esm1 |
clamavopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.4.3-1.1 | 1.4.3-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Alex-Acero-Security/CVE-2025-20260-POC | 2025-10-27 |
| PoC in GitHub | keyuraghao/CVE-2025-20260 | 2025-11-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | CVE List, EUVD | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-20260 is a critical vulnerability (CVSS 9.8) in Cisco Clamav, published June 18, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in clamav 1.4.3-r0.
References
blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html
lists.debian.org/debian-lts-announce/2025/09/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2025-20260
github.com/advisories/GHSA-596c-w2jc-jmmx
security.alpinelinux.org/vuln/CVE-2025-20260
errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1756202550.html
Show 23 moreShow less
security-tracker.debian.org/tracker/CVE-2025-20260
advisories.mageia.org/MGASA-2025-0190.html
bugs.mageia.org/show_bug.cgi?id=34387
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1693
suse.com/support/update/announcement/2025/suse-su-202502119-1
bugzilla.suse.com/1243565
ubuntu.com/security/CVE-2025-20260
cve.org/CVERecord?id=CVE-2025-20260