CVE-2025-20128

Wednesday, January 22, 2025

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected Software

Vendor	Product	Version Range	Status
Cisco	Cisco Secure Endpoint	`7.0.5`	affected
Cisco	Cisco Secure Endpoint	`6.2.19`	affected
Cisco	Cisco Secure Endpoint	`7.3.3`	affected
Cisco	Cisco Secure Endpoint	`7.2.13`	affected
Cisco	Cisco Secure Endpoint	`6.1.5`	affected
Cisco	Cisco Secure Endpoint	`6.3.1`	affected
Cisco	Cisco Secure Endpoint	`6.2.5`	affected
Cisco	Cisco Secure Endpoint	`7.3.5`	affected
Cisco	Cisco Secure Endpoint	`6.2.1`	affected
Cisco	Cisco Secure Endpoint	`7.2.7`	affected
Cisco	Cisco Secure Endpoint	`7.1.1`	affected
Cisco	Cisco Secure Endpoint	`6.3.5`	affected
Cisco	Cisco Secure Endpoint	`6.2.9`	affected
Cisco	Cisco Secure Endpoint	`7.3.1`	affected
Cisco	Cisco Secure Endpoint	`6.1.7`	affected
Cisco	Cisco Secure Endpoint	`7.2.11`	affected
Cisco	Cisco Secure Endpoint	`7.2.3`	affected
Cisco	Cisco Secure Endpoint	`7.1.5`	affected
Cisco	Cisco Secure Endpoint	`6.3.3`	affected
Cisco	Cisco Secure Endpoint	`7.3.9`	affected
Cisco	Cisco Secure Endpoint	`6.2.3`	affected
Cisco	Cisco Secure Endpoint	`6.1.9`	affected
Cisco	Cisco Secure Endpoint	`7.2.5`	affected
Cisco	Cisco Secure Endpoint	`6.3.7`	affected
Cisco	Cisco Secure Endpoint	`1.12.3`	affected
Cisco	Cisco Secure Endpoint	`1.8.0`	affected
Cisco	Cisco Secure Endpoint	`1.11.1`	affected
Cisco	Cisco Secure Endpoint	`1.12.4`	affected
Cisco	Cisco Secure Endpoint	`1.10.0`	affected
Cisco	Cisco Secure Endpoint	`1.12.0`	affected
Cisco	Cisco Secure Endpoint	`1.8.1`	affected
Cisco	Cisco Secure Endpoint	`1.10.1`	affected
Cisco	Cisco Secure Endpoint	`1.12.1`	affected
Cisco	Cisco Secure Endpoint	`1.12.6`	affected
Cisco	Cisco Secure Endpoint	`1.14.0`	affected
Cisco	Cisco Secure Endpoint	`1.10.2`	affected
Cisco	Cisco Secure Endpoint	`1.12.2`	affected
Cisco	Cisco Secure Endpoint	`1.6.0`	affected
Cisco	Cisco Secure Endpoint	`1.11.0`	affected
Cisco	Cisco Secure Endpoint	`1.7.0`	affected
Cisco	Cisco Secure Endpoint	`1.13.0`	affected
Cisco	Cisco Secure Endpoint	`1.12.7`	affected
Cisco	Cisco Secure Endpoint	`1.8.4`	affected
Cisco	Cisco Secure Endpoint	`1.13.1`	affected
Cisco	Cisco Secure Endpoint	`1.9.0`	affected
Cisco	Cisco Secure Endpoint	`1.9.1`	affected
Cisco	Cisco Secure Endpoint	`1.12.5`	affected
Cisco	Cisco Secure Endpoint	`1.13.2`	affected
Cisco	Cisco Secure Endpoint	`8.1.7.21512`	affected
Cisco	Cisco Secure Endpoint	`8.1.7`	affected
Cisco	Cisco Secure Endpoint	`8.1.5`	affected
Cisco	Cisco Secure Endpoint	`8.1.3.21242`	affected
Cisco	Cisco Secure Endpoint	`8.1.3`	affected
Cisco	Cisco Secure Endpoint	`8.1.5.21322`	affected
Cisco	Cisco Secure Endpoint	`8.1.7.21417`	affected

Weaknesses

CWE-122: Heap-based Buffer Overflow

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: partial

CVE Program Container

Additional References

https://lists.debian.org/debian-lts-announce/2025/09/msg00006.html

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.