CVE-2023-20032

FAUCET Score

CVE-2023-20032 is a critical vulnerability in the ClamAV scanning library, affecting versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier, as well as Cisco and Stormshield products utilizing ClamAV. This heap buffer overflow in the HFS+ partition file parser allows unauthenticated, remote attackers to execute arbitrary code or cause a denial of service by submitting a crafted file. With a CVSS score of 9.8 (Critical), the attack requires no user interaction and has high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered significant community discussion and media coverage, indicating high awareness.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.20.2CPE matchmatch criteria	cpe:2.3:a:cisco:secure_endpoint::::::linux::*
		< 1.21.1CPE matchmatch criteria	cpe:2.3:a:cisco:secure_endpoint::::::macos::*
		< 7.5.9CPE matchmatch criteria	cpe:2.3:a:cisco:secure_endpoint::::::windows::*
		>= 8.0.1.21160, < 8.1.5CPE matchmatch criteria	cpe:2.3:a:cisco:secure_endpoint::::::windows::*
		< 3.6.0CPE matchmatch criteria	cpe:2.3:a:cisco:secure_endpoint_private_cloud::::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

29.31%

Probability of exploitation in next 30 days

EPSS Percentile

98.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.2931 is in the 95th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

microsoftpatch availablevia msrc

Product: cbl2 clamav 0.105.2-1 on CBL Mariner 2.0Fixed in: 0.105.2-1

microsoftpatch availablevia msrc

Product: 18402-16823Fixed in: 0.105.2-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 x64Fixed in: 0.105.2-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 ARMFixed in: 0.105.2-1

ciscovendor investigatingvia nvd_reference

View patch

Vendor Advisories (2)

microsoft2023-Mar/CVE-2023-20032

CVE-2023-20032

Mar 14, 2023

microsoft2023-Feb/CVE-2023-20032Critical

On Feb 15 2023 the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier 0.105.1 and earlier and 0.103.7 and earlier could allow an unauthenticated remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process or else crash the process resulting in a denial of service (DoS) condition. For a description of this vulnerability see the ClamAV blog ["https://blog.clamav.net/"].

Feb 14, 2023

References

sec.cloudapps.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy

Vendor Advisory