CVE-2024-20290A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service…
- 7.5HighCVSS base score
- 33.3%Exploitation in 30 daysEPSS · top 1.6% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .
Timeline
ID reserved
By cisco
- 3 months later
· 3 months later
Published
- 12 months later
· 12 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ciscoCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 33.3% · top 1.6% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected 6.0.9
- affected 6.0.7
- affected 6.1.5
- affected 6.1.7
- affected 6.1.9
- affected 6.2.1
- affected 6.2.5
- affected 6.2.19
- affected 6.2.3
- affected 6.2.9
- affected 6.3.5
- affected 6.3.1
- affected 6.3.7
- affected 6.3.3
- affected 7.0.5
- affected 7.1.1
- affected 7.1.5
- affected 7.2.13
- affected 7.2.7
- affected 7.2.3
- affected 7.2.11
- affected 7.2.5
- affected 7.3.1
- affected 7.3.9
- affected 7.3.3
- affected 7.3.5
- affected 8.1.7
- affected 8.1.5
- affected 8.1.3.21242
- affected 8.1.7.21512
- affected 8.1.3
- affected 8.1.5.21322
- affected 8.1.7.21417
Cisco · Cisco Secure Endpoint Private Cloud Administration Portal
- affected N/A
Cisco · Cisco Secure Endpoint Private Cloud Console
- affected N/A
What to do
Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
References
References3
- cisco-sa-clamav-hDffu6t (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-18005 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-20290)Record last updated .