CVE-2024-20290
Published: 07 February 2024
Summary
CVE-2024-20290 is a high-severity Buffer Over-read (CWE-126) vulnerability in Cisco Secure Endpoint. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability in the OLE2 file format parser of ClamAV stems from an incorrect check for end-of-string values during scanning. This flaw produces a heap buffer over-read, which can terminate the scanning process. The issue affects ClamAV installations that process untrusted files containing OLE2 content and carries a CVSS 3.1 score of 7.5.
An unauthenticated remote attacker can trigger the condition by submitting a specially crafted OLE2 file to any ClamAV instance configured to scan incoming content. Successful exploitation causes the scanner to crash, producing a denial-of-service condition that also consumes system resources until the process is restarted.
Cisco and Fedora have published advisories referencing this CVE; operators should apply the updated ClamAV packages listed in those notices to eliminate the vulnerable parser code. The associated EPSS score reached a peak of 0.1035 but has since declined to 0.0859, indicating limited and waning exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18005
Vulnerability details
A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during…
more
scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.