High severity8.4NVD Advisory· Published Feb 12, 2026· Updated Apr 15, 2026

CVE-2020-37167

Description

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cisco Systems, Inc./Clamavreferences
ClamAV/Clamavllm-fuzzy
Range: <0.103.0-rc

Patches

Vulnerability mechanics

References

github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305fnvd
www.clamav.netnvd
www.exploit-db.com/exploits/47687nvd
www.vulncheck.com/advisories/clamav-clambc-clambc-executable-regular-expression-errornvd

News mentions

No linked articles in our index yet.

cvss	0.546
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000