What’s Vulnerable › Vulnerabilities

CVE-2020-37167: ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-12 · updated 2026-09-30

Description

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

Affected products

• ClamAV ClamBC: before 0.103.0-rc — fixed in 0.103.0-rc

How to fix

Upgrade to a fixed version: ClamAV ClamBC 0.103.0-rc. Check the vendor advisory for mitigations.

References

• https://github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f
• https://www.clamav.net/
• https://www.exploit-db.com/exploits/47687
• https://www.vulncheck.com/advisories/clamav-clambc-clambc-executable-regular-expression-error

Get alerted when CVE-2020-37167 or the next vulnerability affects your stack