CVE-2024-20505

HIGH EPSS 42.1%
Published Sep 4, 20241y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Sep 4, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an out of bounds read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. An exploit could allow the attacker to terminate the scanning process.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
42.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 4

VendorProductVersionRange
clamavclamav* <0.103.12
clamavclamav*≥0.104.0  –  <1.0.7
clamavclamav*≥1.2.0  –  <1.3.2
clamavclamav1.4.0any

References 2

  • blog.clamav.net https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html
    PatchVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/12/msg00004.html

Remediation

  • blog.clamav.net https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html
    PatchVendor Advisory