ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability

🚨SEVERITY: MEDIUM — CVSS 5.3Security Advisory

TL;DR 📌

  • A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to…
  • Highest CVSS: 5.3 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20234.

What it is

CVE-2025-20234 is an out-of-bounds read in ClamAV’s Universal Disk Format (UDF) file parsing. The flaw causes a memory overread during UDF scanning, which can crash the ClamAV scanning process.

An unauthenticated, remote attacker exploits this by submitting a crafted file containing UDF content to a device that scans it with ClamAV. No credentials or prior access are needed — the attacker only needs the ability to get a file to the scanner, for example via a file upload or transfer path that triggers a scan.

The impact is denial of service: the scanning process terminates, which delays or blocks further scanning. Cisco notes that overall system stability on affected platforms is not affected — this is a scanner-process crash, not a host or device crash. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects no confidentiality or integrity loss, only availability impact to the scanning function.

The affected component is Cisco Secure Endpoint Connector (Linux, Mac, Windows), which bundles ClamAV. Cisco Secure Endpoint Private Cloud distributes the connector and is also listed as affected in terms of the connector versions it ships, though the Private Cloud platform itself is not vulnerable. Cisco Secure Email Gateway and Secure Web Appliance have been confirmed not affected.

What to do

  • Update Secure Endpoint Connector for Linux and Mac to 1.26.11.
  • Update Secure Endpoint Connector for Windows to 7.5.211 or 8.4.51, depending on your branch.
  • If you run Secure Endpoint Private Cloud, ensure connector updates are picked up through the normal content update process — updated connector builds are available in the connector repository for versions 4.2.2 and earlier.
  • Where policy allows, let Secure Endpoint Connector auto-update via the Secure Endpoint portal rather than relying on manual patching.
  • There are no workarounds for this issue, so patching is the only mitigation — do not rely on configuration changes to reduce exposure.
  • This is not listed in CISA’s Known Exploited Vulnerabilities catalogue.

For leadership 🧭

Executive summary. Cisco Secure Endpoint Connector’s built-in ClamAV can be crashed remotely by an unauthenticated attacker submitting a specially crafted UDF file, stopping malware scanning on the affected endpoint without crashing the host itself. There is no workaround, so this should be scheduled into the next patch cycle rather than treated as an emergency, given the medium severity and lack of known exploitation.

Why it matters:

  • Any attacker who can get a file to a device running Secure Endpoint Connector — via upload, file share, or transfer — can trigger the crash without needing credentials or user interaction.
  • Affects Secure Endpoint Connector on Linux, Mac and Windows, and Secure Endpoint Private Cloud’s connector distribution, meaning mixed-OS endpoint fleets are all in scope.
  • Scanning process termination delays or blocks further malware scanning on that endpoint, creating a window where newly arriving files go unscanned, even though the host itself keeps running.
  • There is no workaround, so exposure persists until the connector is patched — configuration changes will not reduce risk.

Now / Next / Later:

  • Now: Confirm which Secure Endpoint Connector versions are deployed across Linux, Mac and Windows endpoints, and check whether auto-update via the Secure Endpoint portal is enabled and functioning.
  • Next: Update Secure Endpoint Connector to 1.26.11 (Linux/Mac) or 7.5.211/8.4.51 (Windows, per branch); for Secure Endpoint Private Cloud, ensure updated connector builds are pulled through the normal content update process.
  • Later: Bring Secure Endpoint Connector fully under managed auto-update policy so future ClamAV-related fixes reach endpoints without manual patching cycles.

Source