CVE-2025-20128

What it actually does

Integer underflow in OLE2 decryption bounds check allows heap buffer over-read that crashes the ClamAV scanning process.

Why it matters to the business

Disrupts malware scanning services that rely on ClamAV, potentially causing temporary loss of file inspection capability until the process is restarted; widespread use of ClamAV in mail gateways and file servers amplifies operational impact.

How an attack unfolds

An attacker creates a specially crafted OLE2 file that triggers the integer underflow during decryption and submits it to any service performing ClamAV scans; successful processing of the file causes the scanner to terminate, resulting in denial of service.

How to fix it

Upgrade ClamAV to commit 9a2c6425ad4c5a2a38bf641c8e4631243805dcd1 or later; for affected Red Hat Enterprise Linux 7 golang packages update to 1.6.3-1.el7_2.1 or newer packages that contain the corrected ClamAV library.

How to confirm the fix worked

Confirm the running ClamAV binary or library reports the fixed commit hash; re-scan a test corpus containing OLE2 samples and verify the process remains stable without crashes.

Typical attack path

1. Craft a malicious OLE2 file that exploits the integer underflow in the decryption routine
2. Submit the file to a ClamAV-enabled scanning endpoint (email gateway, file upload, etc.)
3. ClamAV processes the file and encounters the bounds-check failure
4. Heap buffer over-read occurs and the scanning process crashes

How to detect it

Monitor ClamAV process logs and system crash reports for abrupt terminations during file scanning; correlate with incoming file submissions containing OLE2 structures.

What your security team should do

• Apply the listed fixed versions immediately on all ClamAV instances
• Add monitoring for unexpected ClamAV process terminations in scanning pipelines
• Review and restrict untrusted file upload paths that feed ClamAV until patches are deployed