23 Oct 2026 15:48:27 UTC
ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
cve-program · CVE-2020-37167 · Published
CVE-2020-37167
ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
CVSS 4.0 8.6 HIGHCVSS 3.1 8.4 HIGHCheck source for fixed versionsKEV status unknown
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2020-37167
PublishedClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
1 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
This historical link shows only this version and versions saved before it. Browse all advisory history.