CVE-2025-20234: Cisco Secure Endpoint · Out-of-bounds Read
Affects Cisco Secure EndpointSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 18 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Secure Endpoint | Affected
| Fixed in– |
AI-suggested
1. Immediate mitigation should focus on monitoring and restricting the types of files scanned by Cisco Secure Endpoint, particularly blocking or quarantining UDF files from untrusted sources until a patch is available. 2. Network-level controls such as email and web gateway filtering should be enhanced to detect and block suspicious UDF files before they reach endpoints. 3. Organizations should implement strict file upload/download policies and educate users about the risks of opening unknown or unsolicited files, even though user interaction is not required for exploitation. 4. Deploy network segmentation and endpoint isolation strategies to limit the spread and impact of potential DoS conditions on endpoint security services. 5. Regularly update Cisco Secure Endpoint software to the latest versions once Cisco releases patches addressing this vulnerability. 6. Engage with Cisco support or security advisories to obtain any available workarounds or hotfixes. 7. Implement robust endpoint monitoring and alerting to detect unusual termination of ClamAV scanning processes, enabling rapid incident response. 8. Consider deploying additional or complementary endpoint protection solutions to provide layered security coverage during the remediation period.
Description
A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software. For a description of this vulnerability, see the .