CVE-2024-20290

CVE-2024-20290 describes a denial-of-service vulnerability in the OLE2 file format parser of ClamAV, impacting various Cisco and Fedora products. An unauthenticated, remote attacker can trigger a heap buffer over-read by submitting a specially crafted OLE2 file for scanning. This vulnerability has a CVSS score of 7.5 (High), indicating it can be exploited over the network with low complexity, requiring no user interaction, to cause a complete denial of service. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the CVE has garnered significant community discussion and media coverage, suggesting awareness among security researchers.