UpHeron
All vulnerabilities

Servers and applications

CVE-2018-0202

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this…

Severity
Medium 5.5
Published
27 Mar 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.6% in the next 30 daysHigher than 85% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Out-of-bounds read (CWE-125)
Attack
Needs local access · No login needed · Needs someone to click or open something
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Sources
NVD

Description

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

From NVD.

Affected software

SoftwareAffected versions
ClamAVServers and applications · cpe:a:clamav:clamav
  • Every version up to 0.99.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-0202
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-0202