CVE catalog

CVE-2025-20234

ClamAV vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.82% · Oct 25, 2026

A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianclamavsid1.4.6+dfsg-1fixed
Debianclamavforky1.4.6+dfsg-1fixed
Debianclamavtrixie1.4.3+dfsg-1fixed
Debianclamavbookworm1.4.3+dfsg-1~deb12u2not affected
Debianclamavbookworm-security1.4.6+dfsg-0+deb12u1not affected
Ubuntuclamavnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-basenoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-daemonnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-docnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-docsnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-freshclamnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-milternoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav-testfilesnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamdscannoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntulibclamav-devnoble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntulibclamav12noble1.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamav22.040.103.3+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1build1vulnerable
Ubuntuclamav22.040.103.5+dfsg-1vulnerable
Ubuntuclamav22.040.103.6+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.8+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.9+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.11+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.12+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.041.4.3+dfsg-0ubuntu0.22.04.1fixed
Ubuntuclamav24.041.0.2+dfsg-1ubuntu1vulnerable
Ubuntuclamav24.041.0.3+dfsg-2ubuntu1vulnerable
Ubuntuclamav24.041.0.4+dfsg-0ubuntu1vulnerable
Ubuntuclamav24.041.0.5+dfsg-1ubuntu1vulnerable
Ubuntuclamav24.041.0.5+dfsg-1.1ubuntu2vulnerable
Ubuntuclamav24.041.0.5+dfsg-1.1ubuntu3vulnerable
Ubuntuclamav24.041.0.7+dfsg-0ubuntu0.24.04.1vulnerable
Ubuntuclamav24.041.0.8+dfsg-0ubuntu0.24.04.1vulnerable
Ubuntuclamav24.041.4.3+dfsg-0ubuntu0.24.04.1fixed
Ubuntuclamavpro0.101.4+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-2ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-2ubuntu2vulnerable
Ubuntuclamavpro0.102.2+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.2+dfsg-2ubuntu1vulnerable
Ubuntuclamavpro0.102.3+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.102.4+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.20.04.2vulnerable
Ubuntuclamavpro0.103.5+dfsg-1~20.04.1vulnerable
Ubuntuclamavpro0.103.6+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.8+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.9+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.11+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.12+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro1.4.3+dfsg-0ubuntu0.20.04.1+esm1fixed
Ubuntuclamavpro0.101.4+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-2ubuntu1vulnerable
Ubuntuclamavpro0.102.1+dfsg-2ubuntu2vulnerable
Ubuntuclamavpro0.102.2+dfsg-1ubuntu1vulnerable
Ubuntuclamavpro0.102.2+dfsg-2ubuntu1vulnerable
Ubuntuclamavpro0.102.3+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.102.4+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.2+dfsg-0ubuntu0.20.04.2vulnerable
Ubuntuclamavpro0.103.5+dfsg-1~20.04.1vulnerable
Ubuntuclamavpro0.103.6+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.8+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.9+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.11+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro0.103.12+dfsg-0ubuntu0.20.04.1vulnerable
Ubuntuclamavpro1.4.3+dfsg-0ubuntu0.20.04.1+esm1fixed
Ubuntuclamav22.040.103.3+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1vulnerable
Ubuntuclamav22.040.103.4+dfsg-1build1vulnerable
Ubuntuclamav22.040.103.5+dfsg-1vulnerable
Ubuntuclamav22.040.103.6+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.8+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.9+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.11+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.040.103.12+dfsg-0ubuntu0.22.04.1vulnerable
Ubuntuclamav22.041.4.3+dfsg-0ubuntu0.22.04.1fixed
Ubuntuclamav24.041.0.2+dfsg-1ubuntu1vulnerable
Ubuntuclamav24.041.0.3+dfsg-2ubuntu1vulnerable
Ubuntuclamav24.041.0.4+dfsg-0ubuntu1vulnerable
Ubuntuclamav24.041.0.5+dfsg-1ubuntu1vulnerable
Ubuntuclamav24.041.0.5+dfsg-1.1ubuntu2vulnerable
Ubuntuclamav24.041.0.5+dfsg-1.1ubuntu3vulnerable
Ubuntuclamav24.041.0.7+dfsg-0ubuntu0.24.04.1vulnerable
Ubuntuclamav24.041.0.8+dfsg-0ubuntu0.24.04.1vulnerable
Ubuntuclamav24.041.4.3+dfsg-0ubuntu0.24.04.1fixed
Opensuseclamavtumbleweed1.4.3-1.1fixed
Suseclamavlinux enterprise module for basesystem 15 sp61.4.3-150600.18.18.1fixed
Suseclamavlinux enterprise module for basesystem 15 sp71.4.3-150600.18.18.1fixed
Opensuseclamavleap 15.61.4.3-150600.18.18.1fixed
Suseclamavlinux enterprise server 12 sp5-ltss1.4.3-3.47.1fixed
Suseclamavlinux enterprise server ltss extended security 12 sp51.4.3-3.47.1fixed
Suseclamavlinux enterprise micro 5.51.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise high performance computing 15 sp3-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise high performance computing 15 sp4-espos1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise high performance computing 15 sp4-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise high performance computing 15 sp5-espos1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise high performance computing 15 sp5-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server 15 sp3-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server 15 sp4-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server 15 sp5-ltss1.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp31.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp41.4.3-150200.8.14.1fixed
Suseclamavlinux enterprise server for sap applications 15 sp51.4.3-150200.8.14.1fixed
Suseclamavmanager proxy 4.31.4.3-150200.8.14.1fixed
Suseclamavmanager server 4.31.4.3-150200.8.14.1fixed
Suseclamaventerprise storage 7.11.4.3-150200.8.14.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianclamavsourcesid1.4.3+dfsg-1not yet assignedNot reported[1108045]
Debianclamavsourceforky1.4.3+dfsg-1not yet assignedNot reported[1108045]
Debianclamavsourcetrixie1.4.3+dfsg-1not yet assignedNot reported[1108045]
DebianclamavsourcebookwormNot affectedunimportantNot reported[1108045]
Ubuntuclamavdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-basedebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-daemondebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-docdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-docsdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-freshclamdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-milterdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamav-testfilesdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamdscandebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntulibclamav-devdebnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntulibclamav12debnoble1.4.3+dfsg-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntuclamavdeb22.041.4.3+dfsg-0ubuntu0.22.04.1Not reportedUSN-7615-1Not reported
Ubuntuclamavdeb24.041.4.3+dfsg-0ubuntu0.24.04.1Not reportedUSN-7615-1Not reported
Ubuntuclamavdebpro1.4.3+dfsg-0ubuntu0.20.04.1+esm1Not reportedUSN-7615-2Not reported
Ubuntuclamavdebpro1.4.3+dfsg-0ubuntu0.20.04.1+esm1Not reportedUBUNTU-CVE-2025-20234Not reported
Ubuntuclamavdeb22.041.4.3+dfsg-0ubuntu0.22.04.1Not reportedUBUNTU-CVE-2025-20234Not reported
Ubuntuclamavdeb24.041.4.3+dfsg-0ubuntu0.24.04.1Not reportedUBUNTU-CVE-2025-20234Not reported
Opensuseclamavrpmtumbleweed1.4.3-1.1Not reportedOPENSUSE-SU-2025:15211-1Not reported
Suseclamavrpmlinux enterprise module for basesystem 15 sp61.4.3-150600.18.18.1Not reportedSUSE-SU-2025:02200-1Not reported
Suseclamavrpmlinux enterprise module for basesystem 15 sp71.4.3-150600.18.18.1Not reportedSUSE-SU-2025:02200-1Not reported
Opensuseclamavrpmleap 15.61.4.3-150600.18.18.1Not reportedSUSE-SU-2025:02200-1Not reported
Suseclamavrpmlinux enterprise server 12 sp5-ltss1.4.3-3.47.1Not reportedSUSE-SU-2025:02201-1Not reported
Suseclamavrpmlinux enterprise server ltss extended security 12 sp51.4.3-3.47.1Not reportedSUSE-SU-2025:02201-1Not reported
Suseclamavrpmlinux enterprise micro 5.51.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp3-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp4-espos1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp4-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp5-espos1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise high performance computing 15 sp5-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server 15 sp3-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server 15 sp4-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server 15 sp5-ltss1.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp31.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp41.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmlinux enterprise server for sap applications 15 sp51.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmmanager proxy 4.31.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmmanager server 4.31.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported
Suseclamavrpmenterprise storage 7.11.4.3-150200.8.14.1Not reportedSUSE-SU-2025:02119-1Not reported

[Debian bug #1108045]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [clamav-devel]Unknown

    Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

  • Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

  • [clamav-milter]Unknown

    Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

  • [libclamav12]Unknown

    Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

  • Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

  • [libfreshclam4]Unknown

    Source package: [clamav]

    Details (1)
    • 1.5.4-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.4.3-1.1

      Version impact unknown

      usn · clamav · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [clamav]Not affected
    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-base]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-daemon]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-doc]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-docs]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-freshclam]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-milter]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamav-testfiles]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · all · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [clamdscan]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [libclamav12]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

  • [libclamav-dev]Not affected

    Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1~deb12u2 · amd64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

    • 1.4.3+dfsg-1~deb12u2 · arm64 · bookworm

      Not affected

      usn · clamav · debian · bookworm

[Debian 13 (Trixie)]

  • [clamav]Fixed
    Details (2)
    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

  • Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

    • 1.4.3+dfsg-1 · all · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

  • Source package: [clamav]

    Details (2)
    • 1.4.3+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

    • 1.4.3+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 1.4.3+dfsg-1

      usn · clamav · debian · 13

Next results

Observed:

References