Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-20128

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CVSS 5.3 · MediumBuzz score 39.5

Buzz score

Why this CVE is surfacing

Buzz score total 39.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 17.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
17.5
7 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • Week in review: 48k Fortinet firewalls open to attack, attackers “vishing” orgs via Microsoft TeamsHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 48,000+ internet-facing Fortinet firewalls still open to attack Despite last week’s confirmation of and warnings about long-standing exploitation of CVE-2024-55591, a critical vulnerability affecting Fortinet Fortigate firewalls, too many vulnerable devices are still accessible from the Internet and open to attack: over 48,000, according to data from the Shadowserver Foundation. Ransomware attackers are “vishing” organizations via Microsoft Teams The “email … More →

    newswww.helpnetsecurity.comJan 26, 2025, 9:00 AM
  • Cisco warns of a ClamAV bug with PoC exploitSecurity Affairs

    Cisco addressed a ClamAV denial-of-service (DoS) vulnerability, and experts warn of the availability of a proof-of-concept (PoC) exploit code. Cisco has released security updates to address a ClamAV denial-of-service (DoS) vulnerability tracked as CVE-2025-20128. The Cisco PSIRT experts warn of the availability of a proof-of-concept (PoC) exploit code for this flaw. The vulnerability resides in […]

    newssecurityaffairs.comJan 26, 2025, 6:58 AM
  • Cisco fixes ClamAV vulnerability with available PoC and critical Meeting Management flawHelp Net Security

    Cisco has released patches for a critical privilege escalation vulnerability in Meeting Management (CVE-2025-20156) and a heap-based buffer overflow flaw (CVE-2025-20128) that, when triggered, could terminate the ClamAV scanning process on endpoints running a Cisco Secure Endpoint Connector. Proof-of-concept (PoC) exploit code for CVE-2025-20128 is available, Cisco said, but the company is not aware of the vulnerability being exploited in the wild. Credit for reporting the flaw has been given to OSS-Fuzz, Google’s continuous fuzzing … More →

    newswww.helpnetsecurity.comJan 23, 2025, 12:57 PM
  • Cisco Patches Critical Vulnerability in Meeting ManagementSecurityWeek

    Cisco has released patches for three vulnerabilities, including a critical privilege escalation bug and a DoS flaw for which exploit code exists.

    newswww.securityweek.comJan 23, 2025, 11:42 AM
  • Cisco patches antivirus decommissioning bug as exploit code surfacesCSO Online

    Cisco has patched a denial-of-service (DoS) vulnerability affecting its open-source antivirus software toolkit, ClamAV, which already has a proof-of-concept (PoC) exploit code available to the public. Identified as CVE-2025-20128, the vulnerability stems from a heap-based buffer overflow in the Object Linking and Embedding 2 (OLE2) decryption routine, enabling unauthenticated remote attackers to cause a DoS […]

    newswww.csoonline.comJan 23, 2025, 11:39 AM
  • https://lists.debian.org/debian-lts-announce/2025/09/msg00006.htmllists.debian.org

    No excerpt available.

    Vendor Advisorylists.debian.orgJan 22, 2025, 5:15 PM
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphAsec.cloudapps.cisco.com

    No excerpt available.

    Vendor Advisorysec.cloudapps.cisco.comJan 22, 2025, 5:15 PM
  • https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.htmlblog.clamav.net

    No excerpt available.

    Vendor Advisoryblog.clamav.netJan 22, 2025, 5:15 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence