{
  "cveId": "CVE-2025-20128",
  "url": "https://patchblox.com/security/cve/CVE-2025-20128",
  "summary": "CVE-2025-20128 is fixed in 25 products on 1 platform, first by clamav 1.0.8\u002Bdfsg-0ubuntu0.24.04.1, released January 22, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "clamav: A vulnerability in the Object Linking and Embedding 2 (OLE2) decryptionroutine of ClamAV could allow an unauthenticat...",
  "description": "A vulnerability in the Object Linking and Embedding 2 (OLE2) decryptionroutine of ClamAV could allow an unauthenticated, remote attacker to causea denial of service (DoS) condition on an affected device.This vulnerability is due to an integer underflow in a bounds check thatallows for a heap buffer overflow read. An attacker could exploit thisvulnerability by submitting a crafted file containing OLE2 content to bescanned by ClamAV on an affected device. A successful exploit could allowthe attacker to terminate the ClamAV scanning process, resulting in a DoScondition on the affected software.For a description of this vulnerability, see the .Cisco has released software updates that address this vulnerability. Thereare no workarounds that address this vulnerability.",
  "published": "2025-01-22T16:00:00Z",
  "severity": "Medium",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01815,
  "epssPercentile": 0.78811,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "1.0.9\u002Bdfsg-1~deb11u1",
      "fix": "DLA-4292-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4292-1",
      "released": "2025-09-04T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.0.9\u002Bdfsg-1~deb12u1",
      "fix": "DEBIAN-CVE-2025-20128",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-20128",
      "released": "2025-01-22T17:15:12Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.4.2\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2025-20128",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-20128",
      "released": "2025-01-22T17:15:12Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Debian 14",
      "fixedVersion": "1.4.2\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2025-20128",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-20128",
      "released": "2025-01-22T17:15:12Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.4.2-150600.18.6.1",
      "fix": "SUSE-SU-2025:0327-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0327-1",
      "released": "2025-02-03T09:39:39Z"
    },
    {
      "platform": "linux",
      "product": "clamav",
      "release": "sles 15.6",
      "fixedVersion": "1.4.2-150600.18.6.1",
      "fix": "SUSE-SU-2025:0327-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0327-1",
      "released": "2025-02-03T09:39:39Z"
    },
    {
      "platform": "linux",
      "product": "clamav-base",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-base 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-base-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-base",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav-base 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-base-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-daemon",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-daemon 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-daemon-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-daemon",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav-daemon 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-daemon-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-docs",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-docs 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-docs-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-freshclam",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-freshclam 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-freshclam-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-freshclam",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav-freshclam 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-freshclam-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-milter",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-milter 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-milter-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-milter",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav-milter 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-milter-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-testfiles",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamav-testfiles 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamav-testfiles-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav-testfiles",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamav-testfiles 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamav-testfiles-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-data",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-devel",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-doc",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-filesystem",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-freshclam",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-freshclam-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-lib",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-lib-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-milter",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamav1.4-milter-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamd1.4",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamd1.4-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.4.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2025-866",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-866",
      "released": "2025-02-26T23:14:00Z"
    },
    {
      "platform": "linux",
      "product": "clamdscan",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "clamdscan 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-clamdscan-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "clamdscan",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "clamdscan 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-clamdscan-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libclamav11t64",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "fix": "libclamav11t64 1.0.8\u002Bdfsg-0ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libclamav11t64-1.0.8-dfsg-0ubuntu0.24.04.1",
      "released": "2025-01-22T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libclamav12",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "fix": "libclamav12 1.4.2\u002Bdfsg-0ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libclamav12-1.4.2-dfsg-0ubuntu0.24.10.1",
      "released": "2025-01-23T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}