CVE-2020-37167

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

CVSS v4.0

8.6 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

8.4 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.17% chance of exploitation in the next 30 days, 7th percentile

Published

2026-02-12

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47687

References

• CVE Record
• NVD entry

Related

• CVE-2020-37166
• CVE-2020-37168
• CVE-2020-37165
• CVE-2020-37169
• CVE-2020-37164
• CVE-2020-37170