CVE-2025-20128: Cisco Secure Endpoint · Heap-based Buffer Overflow
Affects Cisco Secure EndpointSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 1.8% chance of exploitation in 30 days – higher than 78% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 22 Jan 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Secure Endpoint | Affected
| Fixed in– |
AI-suggested
1. Immediately identify all instances of Cisco Secure Endpoint deployed within the organization and verify their versions against the affected list. 2. Prioritize deployment of Cisco's official patches or updates that address CVE-2025-20128 to all affected systems without delay. 3. Implement strict file upload and scanning policies to limit exposure to untrusted or suspicious OLE2 files, especially from external sources. 4. Monitor endpoint security logs and ClamAV scanning processes for abnormal terminations or crashes that could indicate attempted exploitation. 5. Employ network segmentation and access controls to reduce the attack surface and limit the ability of attackers to submit crafted files to vulnerable endpoints. 6. Maintain up-to-date backups and incident response plans to quickly recover from potential service disruptions. 7. Engage with Cisco support or security advisories regularly to stay informed about any further developments or additional patches. 8. Consider deploying additional layered endpoint detection and response (EDR) tools to provide fallback protection during patch rollout.
Description
A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buffer overflow read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the . Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.