CVE-2025-20260

Publication date 18 June 2025

Last updated 2 July 2025

Ubuntu priority

Cvss 3 Severity Score

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
clamav	25.04 plucky	Fixed 1.4.3+dfsg-0ubuntu0.25.04.1
	24.10 oracular	Fixed 1.4.3+dfsg-0ubuntu0.24.10.1
	24.04 LTS noble	Fixed 1.4.3+dfsg-0ubuntu0.24.04.1
	22.04 LTS jammy	Fixed 1.4.3+dfsg-0ubuntu0.22.04.1
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation

Severity score breakdown

Parameter	Value
Base score	9.8 · Critical
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)