CVE-2020-37167

High

Description

ClamAV versions prior to 0.103.0-rc contain a vulnerability in function name processing through the ClamBC bytecode interpreter that allows attackers to manipulate bytecode function names. Attackers can exploit the weak input validation in function name encoding to potentially execute malicious bytecode or cause unexpected behavior in the ClamAV engine.

SeverityHigh

CVSS8.4

Exploit probability—

ProductClamBC

PublishedFeb 12, 2026

First seenFeb 12, 2026

How to fix

Update

ClamAV ClamBC0.103.0-rc or later

Patches

github.com/Cisco-Talos/clamav/commit/cd2f2975b93277de7f74464d48adb378375a305f

Affected products

Product	Affected versions	Fixed in
ClamAV ClamBC	v < 0.103.0-rc	0.103.0-rc

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.