**Cisco Zero-Day**: [ClamAV OLE2 File Format Decryption Denial of Service Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA )
CVE-2025-20128 (5.3 medium) A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read.
> The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.
> The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.
Two more Cisco security advisories:<li><a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-privesc-uy2Vf8pc"; target="_blank" rel="nofollow noopener">Cisco Meeting Management REST API Privilege Escalation Vulnerability</a> CVE-2025-20156 (<strong>9.9 critical</strong>) </li><li><a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-sip-dos-mSySbrmt"; target="_blank" rel="nofollow noopener">Cisco BroadWorks SIP Denial of Service Vulnerability</a> CVE-2025-20165 (7.5 high)</li>
These two do not mention proof of concept or [exploitation](https://infosec.press/screaminggoat/vendor-verbiage ).
#cisco #vulnerability #cve #infosec #cybersecurity
Not Simon 🐐
npub14g…xznd6
2025-01-22 16:15:21 UTC
Author Public Key
npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6Seen on
wss://relay.momostr.pinkPublished at
2025-01-22 16:15:21 UTCEvent JSON
{
"id": "7fdea4a5225fe72fc0ffcb212c866cc1a5d7b0121c9a55824cb81003181a74d5",
"pubkey": "aa1fb93d3b9be190a7970a9dc092de69cc41787910763329098758561bee3102",
"created_at": 1737562521,
"kind": 1,
"tags": [
[
"t",
"infosec"
],
[
"t",
"cisco"
],
[
"t",
"cve"
],
[
"t",
"cybersecurity"
],
[
"t",
"vulnerability"
],
[
"proxy",
"https://infosec.exchange/@screaminggoat/113872897424390072",
"web"
],
[
"proxy",
"https://infosec.exchange/users/screaminggoat/statuses/113872897424390072",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/screaminggoat/statuses/113872897424390072",
"pink.momostr"
],
[
"-"
]
],
"content": "**Cisco Zero-Day**: [ClamAV OLE2 File Format Decryption Denial of Service Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA )\nCVE-2025-20128 (5.3 medium) A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read.\n\n\u003e The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\n\u003e The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.\n\nTwo more Cisco security advisories:\u003cli\u003e\u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-privesc-uy2Vf8pc\" target=\"_blank\" rel=\"nofollow noopener\"\u003eCisco Meeting Management REST API Privilege Escalation Vulnerability\u003c/a\u003e CVE-2025-20156 (\u003cstrong\u003e9.9 critical\u003c/strong\u003e) \u003c/li\u003e\u003cli\u003e\u003ca href=\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-sip-dos-mSySbrmt\" target=\"_blank\" rel=\"nofollow noopener\"\u003eCisco BroadWorks SIP Denial of Service Vulnerability\u003c/a\u003e CVE-2025-20165 (7.5 high)\u003c/li\u003e\n\nThese two do not mention proof of concept or [exploitation](https://infosec.press/screaminggoat/vendor-verbiage ).\n\n#cisco #vulnerability #cve #infosec #cybersecurity",
"sig": "aa418b933bd18d1ad364d0344f82dcae30839070f97e5b455f8c009e8121637444f407a3fea6d5b3e9de2417c3875e36d6c6ac6ddf6526cba46b32387658e31c"
}