CVE-2020-37167
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
- Affected products
- Clamav
- Fix
- Available
- CVSS 4.0
- 8.6 HIGH
- CVSS 3.1
- 8.4 HIGH
- EPSS
- 0.2% (7th percentile)
- NVD status
- Deferred
- Published
- 2026-02-12
CVE-2020-37167 at NVD
No indexed exploits for CVE-2020-37167 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2020-37167 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.