Cisco has released new versions of the free antivirus package ClamAV 1.4.2 and 1.0.8, which address a vulnerability (CVE-2025-20128). The vulnerability is caused by a buffer overflow in the code that parses files containing OLE2 (Object Linking and Embedding 2) format content, which a remote unauthenticated attacker could exploit for denial of service. The issue has existed since ClamAV 1.0.0 and was identified during fuzz testing by the OSS-Fuzz project.
The vulnerability is caused by an integer overflow during boundary checks, leading to reading outside the allocated buffer. The issue occurs when processing files containing specially crafted content in OLE2 format and causes the scanning process to crash. A prototype exploit has been reported in the wild that could be used to attack mail servers or file-sharing systems that use ClamAV.
Source: opennet.ru
