Security readout for executives and security teams
Plain-English summary
CVE-2020-37167 affects ClamAV’s ClamBC bytecode interpreter before 0.103.0-rc. Weak validation of bytecode function names may let an attacker influence bytecode handling, potentially causing malicious bytecode execution or unexpected engine behavior. Treat this as high priority where ClamAV processes untrusted content or bytecode.
Executive priority
Prioritize remediation for production malware-scanning infrastructure because compromise or instability in antivirus scanning can affect security operations, mail gateways, file processing, and incident response workflows. Public exploit information increases urgency, but active exploitation is not confirmed in the provided sources.
Technical view
The issue is in function name processing within the ClamBC bytecode interpreter. Sources describe a regular expression/input validation flaw in function name encoding. The provided CVSS 4.0 score is 8.6 with local attack vector, no privileges, and high impacts to confidentiality, integrity, and availability.
Likely exposure
Systems running ClamAV/ClamBC versions earlier than 0.103.0-rc are the stated exposure. Risk is most relevant where the engine processes untrusted bytecode or content that can reach the bytecode interpreter. The source bundle does not fully enumerate distributions, packages, or downstream products.
Exploitation context
A public Exploit-DB reference exists, and a patch commit is cited. The CVE is not marked CISA KEV in the provided data, and the sources do not establish active exploitation. Do not assume exploitation in the wild without additional evidence.
Researcher notes
Key evidence is the CVE description, VulnCheck advisory, Exploit-DB reference, and Cisco Talos patch commit. Affected-version metadata is limited and should be verified against vendor or distribution advisories. Avoid inferring downstream product exposure unless the vendor confirms bundled vulnerable ClamAV/ClamBC versions.
Mitigation direction
- Upgrade ClamAV/ClamBC to 0.103.0-rc or later, where applicable.
- Confirm vendor or distribution packages include the cited patch commit.
- Review ClamAV vendor guidance for any environment-specific mitigations.
- Prioritize scanners handling untrusted files or bytecode-enabled workflows.
Validation and detection
- Inventory ClamAV and ClamBC versions across servers, containers, and appliances.
- Flag installations earlier than 0.103.0-rc as potentially vulnerable.
- Check package changelogs or source builds for the cited patch commit.
- Review scanner logs for crashes or unexpected ClamBC behavior.
- Verify remediation by confirming upgraded version or patched build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-37167 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47687CVE reference · exploit
- https://github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305fCVE reference · patch
- https://www.clamav.net/CVE reference · product
- https://www.vulncheck.com/advisories/clamav-clambc-clambc-executable-regular-expression-errorCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.