HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2024-20380

CVSS 7.5v3.1pub. 2024-04-18upd. 2025-07-23

A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Clamav

    APP
    Clamav
    1.3.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2025-20260CRITICAL9.8PL ✓ten sam produkt

ClamAV: buffer overflow w skanowaniu PDF umożliwia DoS lub RCE

CVE-2023-20032CRITICAL9.8ten sam produkt

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerabilit...

CVE-2013-7088CRITICAL9.8ten sam produkt

ClamAV before 0.97.7 has buffer overflow in the libclamav component

CVE-2013-7087CRITICAL9.8ten sam produkt

ClamAV before 0.97.7 has WWPack corrupt heap memory

CVE-2007-6745CRITICAL9.8ten sam produkt

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.