Vulnerability · Published Feb 12, 2026 · Assigned by VulnCheck
CVE-2020-37167ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
High 8.4
In plain English
A high-severity security flaw in ClamBC from ClamAV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 90.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | clamav | 0.103.0+dfsg-1 | DEBIAN-CVE-2020-37167 |
| Debian:13 | clamav | 0.103.0+dfsg-1 | DEBIAN-CVE-2020-37167 |
| Debian:14 | clamav | 0.103.0+dfsg-1 | DEBIAN-CVE-2020-37167 |
| Ubuntu:22.04:LTS | clamav | no fix listed | UBUNTU-CVE-2020-37167 |
| Ubuntu:24.04:LTS | clamav | no fix listed | UBUNTU-CVE-2020-37167 |
| Ubuntu:25.10 | clamav | no fix listed | UBUNTU-CVE-2020-37167 |
| Ubuntu:22.04:LTS | libclamunrar | no fix listed | UBUNTU-CVE-2020-37167 |
| Ubuntu:24.04:LTS | libclamunrar | no fix listed | UBUNTU-CVE-2020-37167 |
| Ubuntu:25.10 | libclamunrar | no fix listed | UBUNTU-CVE-2020-37167 |