CVE-2022-20785: ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-04 · updated 2026-06-17
Weakness: CWE-401

Description

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Affected products

Cisco Secure Endpoint: before 1.16.3; before 1.17.2; before 7.5.5; from 1.18.0 before 1.18.2 — fixed in 1.16.3, 1.17.2, 1.18.2, 7.5.5
Cisco ClamAV: before 0.103.5; through 0.103.5; from 0.104.0 before 0.104.2 — fixed in 0.103.5, 0.104.2
Debian Linux: 9.0
Fedoraproject Fedora: 34, 35, 36

How to fix

Upgrade to a fixed version: Cisco Secure Endpoint 1.16.3, 1.17.2, 1.18.2, 7.5.5; Cisco ClamAV 0.103.5, 0.104.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20785 or the next vulnerability affects your stack