CVE-2024-20505

What it actually does

Out-of-bounds read in the PDF parsing module terminates the ClamAV scanning process.

Why it matters to the business

Disrupts malware scanning operations across email gateways, file servers, and endpoints, potentially allowing threats to go undetected during outages.

How an attack unfolds

An attacker creates a specially crafted PDF file and submits it to any ClamAV instance for scanning; the malformed PDF triggers an out-of-bounds read that crashes the scanner.

How to fix it

Upgrade cisco-talos/clamav to commit 93d9e734200ad2eec6d1af6d52e0a4b7a7ae5d26 or a later release that contains the fix.

How to confirm the fix worked

Confirm the running binary or package reports a version containing commit 93d9e734200ad2eec6d1af6d52e0a4b7a7ae5d26; re-scan a set of known PDF samples and verify the process remains stable.

Typical attack path

1. Craft a malicious PDF that triggers an out-of-bounds read during parsing
2. Deliver the PDF via email, file upload, or network share to a system using ClamAV
3. Trigger ClamAV to scan the file
4. Cause the scanning process to terminate

How to detect it

Review system and ClamAV logs for abrupt termination of scanning processes when PDF files are processed; correlate with file submission timestamps.

What your security team should do

• Apply the fixed commit or newer release to all ClamAV deployments
• Add monitoring for unexpected ClamAV process exits in system and application logs
• Temporarily disable PDF scanning only if an immediate upgrade is impossible and risk is accepted