CVE-2024-20380: cisco clamav Undefined Behavior for Input to API
Vulnerability summary
CVE-2024-20380 is a high (CVSS 7.5) Undefined Behavior for Input to API vulnerability in cisco clamav. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 18-04-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco1 product
- clamavEOL1.3
Clamav1 product
- clamavEOL1.3.0 | 1.3.0:rc | 1.3.0:rc2
Opensuse1 product
- clamav&distro=openSUSE Tumbleweed< 1.3.1-1.1
3 vendors · 3 products