High
Security advisory
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-37167
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
osv:CVE-2020-37167
Complete source record
{
"id": "446dd3fd070f990d0d11d4f852b4c37c2e2223a2289bd7ca42b2541a213cc20a",
"url": "https://osv.dev/vulnerability/CVE-2020-37167",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-37167",
"summary": "ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.",
"evidence": "osv:CVE-2020-37167",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-37167",
"aliases": [
"CVE-2020-37167"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cisco-talos/clamav",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "854d38de546a53e3c27b90965b8d89804acfdf02"
},
{
"fixed": "cd2f2975b93277de7f74464d48adb378375a305f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.103.0-rc"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "cd2f2975b93277de7f74464d48adb378375a305f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"clamav-0.102.0",
"clamav-0.101.0",
"clamav-0.97",
"clamav-0.97rc",
"clamav-0.96.5",
"clamav-0.96.4",
"clamav-0.96.3",
"clamav-0.96.2",
"clamav-0.96",
"clamav-0.96rc2",
"clamav-0.96rc1",
"merge-llvm-97877",
"r5076"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37167.json",
"vanir_signatures": [
{
"id": "CVE-2020-37167-0bb8cd9a",
"digest": {
"length": 1692,
"function_hash": "22599797907414722464659801424665383648"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/client.c",
"function": "ping_clamd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-233b5bf6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"258287229122960066526305161540484572432",
"133108484896280132026513204697044915602",
"38027455530152731521457639074083325444",
"334715647810890587684562740399179295986",
"132210115132739307668679821357348402644",
"263853581888740915156239612409111587608",
"42968746016626670686991226537921830763",
"260257863686603665939650277053984918847",
"220567141142655036135912109351945055839",
"149462719253495444496128443065781267673",
"316517136435113683594703126397423496278",
"263383921687464260618757621048515819182",
"48478377143763010323375369616564318153",
"299470815158447234819819084245330539176",
"261246768202589690387643506820491034233"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/client/client.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-3eae5241",
"digest": {
"length": 4001,
"function_hash": "197692853761140123394134975151252655034"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/fanotif/fanotif.c",
"function": "onas_fan_eloop"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-42a87723",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6845275656085664560088075897144213936",
"50689903831671583891477432400696470735",
"223326227844162913378380033664841594055",
"320681948466540779391556695050337045172",
"230122812714160278193466679709994969691",
"159334995745666464516584562300527750367",
"309809507576000561625069053602198310142",
"300330702863222041840563659389777240399",
"2184814101818528581220296403356643098",
"170080545262882321936465775455807325514",
"296254465832609572805911433507914815866",
"190647568172116494054168821530729378546",
"258978834744102205052721767860896258301",
"184201634458679042124572481362381336157",
"123198141682004011137815232927199668957",
"183119939117662693545157007007466023882",
"244135606051991190131181693302535240063",
"191975519734993132613110455991681106780",
"188933332893647046618490541354911426282",
"20630535356722993715473930845302280819",
"226726405492254546745532236264580055783",
"222336147167216769668014840660181984073",
"49781570555784704300353112434256247647",
"37933920841237038430038530551373875877",
"338393784924759878299127267506577183785",
"103949058558527791647975358522082075119",
"65210468753792666486205138799046404625",
"260889484228942512848427071595474458681",
"123198141682004011137815232927199668957",
"235850219348437095255029026338633748320",
"119736940987488281810636859698464316178",
"304097156400467290339778237691487003794",
"133948063648740558878178176123096545073",
"20630535356722993715473930845302280819",
"119511100040818730193325444631767055164",
"103949058558527791647975358522082075119",
"65210468753792666486205138799046404625",
"260889484228942512848427071595474458681",
"123198141682004011137815232927199668957",
"235850219348437095255029026338633748320",
"119736940987488281810636859698464316178",
"304097156400467290339778237691487003794",
"133948063648740558878178176123096545073",
"20630535356722993715473930845302280819",
"268914868530021619653321014453059332457",
"251708787152002751274355528628130532425",
"221137233623842586257957803433295281780",
"152317589571608611438770330046890487698",
"287651660223196751578897743495699241508",
"193599235760642131941041926240560719133",
"129120019329052947016011480355853062727",
"185612567544745537091248657832925749399",
"60781389010781988090877390348196530061",
"182420246007371667135571683299079810633",
"185066527277473664791333257383160992726",
"276231423024067077062025623181744134391",
"128822010294807620674824694987717734041",
"209673568854727159447863844106425086180",
"126744712666990703653295411257570214064",
"290692811495672805492180150306945144996",
"331826025145942487030688759601962586886",
"285416895403243955336592876352248839352",
"287840222199849201322841316273294291566",
"315006728337680501052086358162816442601",
"339153014545636521224386745368776929896",
"315866164810021375671746758468536105291",
"86059711692568332097677067060712989501",
"213865648247573706925187704589173101815",
"293623503023221385839700657467411387061",
"271583499172885086344222382544513708196",
"282495565758324722113739334878465362658",
"115557254543987910608036579623045446034",
"333186355939847916761955695618609159578",
"266221793299317849897135862048333214471",
"76883067893616298334838768804030944545"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/clamonacc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-60c142a7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"189616802374571960905732736673932876259",
"260765539758725929754043961912144044434",
"144282043768447633786446550525450574074",
"109473368415169997600699099485099052240",
"229032267276227490599492869478494449334",
"38156694841526526591947071059980947062",
"30860247435651971081354231760941232424",
"44182189279614837749618283789919124922",
"188724235052366195665789727964930705570",
"191797690572595724652906820151066817009"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/fanotif/fanotif.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-6db5e858",
"digest": {
"length": 2423,
"function_hash": "155062218303651394716261876469331177575"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/client.c",
"function": "client"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-6e495cb5",
"digest": {
"length": 9596,
"function_hash": "148459003788419734165499019283961617796"
},
"source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
"target": {
"file": "clamscan/clamscan.c",
"function": "help"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-793d62f3",
"digest": {
"length": 2422,
"function_hash": "58161993787548219215208658096686786564"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/clamonacc.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-834fecc2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106408459869373235257750722575119413454",
"240679148377164762295485940777004739424",
"337586465132289121067143456422797591531",
"148429844097337696780210272830939777011"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
"target": {
"file": "clambc/bcrun.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-8d3dd66a",
"digest": {
"length": 2337,
"function_hash": "322656259478487021347026451652293671019"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/client/client.c",
"function": "onas_setup_client"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-9001bfb9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300135742121329154209605564707232899265",
"25711749993336170408433539590972442926"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/client/client.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-a2d15065",
"digest": {
"length": 3469,
"function_hash": "167592726635174250239689365165810359384"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/clamdscan.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-b7350eee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303164250971930418116974909361803411375",
"183853009528802975421205441851847665370",
"200453439829448750915990055448628651586",
"287326728582701155732152354563803866722",
"187217884733339712565056533912393872962",
"309170341801048815291552660729452112206",
"147426611498457289175504768742166715778",
"308206121529535185804869176557320995783",
"228312128693998983666007601259717011891",
"144996954544113916757003117901917599870",
"274780052270896860577139250761695056667",
"26311835423531471178088397702577170565",
"174007288110686531387118601143472292577",
"129583144252923439954253883037906775642",
"14123288974262166687983445941638226429"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/clamdscan.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-b7e1f87a",
"digest": {
"length": 2411,
"function_hash": "319099642839516231756972946597436079926"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/client/client.c",
"function": "onas_ping_clamd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-d1261cec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191718247534306042539625511569012605262",
"58756646025466442967636112104272047953",
"158072926320145078770359338928999650907",
"79570584781485255077898755623269705818"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
"target": {
"file": "clamscan/clamscan.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-d1926656",
"digest": {
"threshold": 0.9,
"line_hashes": [
"45369902672771399579418896259376023236",
"257732791402044802477535629200112672913"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/client.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-d1ac01a6",
"digest": {
"length": 2266,
"function_hash": "168312060395043906144956489134026369479"
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamonacc/clamonacc.c",
"function": "startup_checks"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-d7cd692b",
"digest": {
"length": 1558,
"function_hash": "241550728163143469195026663349662122787"
},
"source": "https://github.com/cisco-talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f",
"target": {
"file": "clambc/bcrun.c",
"function": "help"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-37167-f412a8eb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"132210115132739307668679821357348402644",
"263853581888740915156239612409111587608",
"153769866360549751517053371999144117168",
"174860194568382827426371977075546086954",
"140942041530502039217728563574097850291",
"91830639276270041671959622792138358307",
"44996583680097789446604547727552262554",
"112977669965290971764224319629427654775",
"322817037530276858492348658517070223190"
]
},
"source": "https://github.com/cisco-talos/clamav/commit/854d38de546a53e3c27b90965b8d89804acfdf02",
"target": {
"file": "clamdscan/client.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:59:39Z"
}
}
],
"modified": "2026-10-20T13:59:39.855485986Z",
"provider": "osv",
"references": [
"https://www.clamav.net/",
"https://www.exploit-db.com/exploits/47687",
"https://www.vulncheck.com/advisories/clamav-clambc-clambc-executable-regular-expression-error",
"https://github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-37167",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388494,
"published_at": "2026-02-12T23:16:08.887+00:00"
}