CVE-2023-20197 — A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device

Back Back to CVE browser

HIGH

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device

Published Aug 16, 2023

7.5

HIGH

CVSS 3.1

EPSS 1.17%

Description

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

Affected products

Vendor Cisco Product Cisco Secure Endpoint Default
n/a
- Version
  1.10.0
  Status
  affected
  Constraints
  -
- Version
  1.10.1
  Status
  affected
  Constraints
  -
- Version
  1.10.2
  Status
  affected
  Constraints
  -
- Version
  1.11.0
  Status
  affected
  Constraints
  -
- Version
  1.12.0
  Status
  affected
  Constraints
  -
- Version
  1.12.1
  Status
  affected
  Constraints
  -
- Version
  1.12.2
  Status
  affected
  Constraints
  -
- Version
  1.12.3
  Status
  affected
  Constraints
  -
- Version
  1.12.4
  Status
  affected
  Constraints
  -
- Version
  1.12.5
  Status
  affected
  Constraints
  -
- Version
  1.12.6
  Status
  affected
  Constraints
  -
- Version
  1.12.7
  Status
  affected
  Constraints
  -
- Version
  1.13.0
  Status
  affected
  Constraints
  -
- Version
  1.13.1
  Status
  affected
  Constraints
  -
- Version
  1.13.2
  Status
  affected
  Constraints
  -
- Version
  1.14.0
  Status
  affected
  Constraints
  -
- Version
  1.6.0
  Status
  affected
  Constraints
  -
- Version
  1.7.0
  Status
  affected
  Constraints
  -
- Version
  1.8.0
  Status
  affected
  Constraints
  -
- Version
  1.8.1
  Status
  affected
  Constraints
  -
- Version
  1.8.4
  Status
  affected
  Constraints
  -
- Version
  1.9.0
  Status
  affected
  Constraints
  -
- Version
  1.9.1
  Status
  affected
  Constraints
  -
- Version
  6.0.7
  Status
  affected
  Constraints
  -
- Version
  6.0.9
  Status
  affected
  Constraints
  -
- Version
  6.1.5
  Status
  affected
  Constraints
  -
- Version
  6.1.7
  Status
  affected
  Constraints
  -
- Version
  6.1.9
  Status
  affected
  Constraints
  -
- Version
  6.2.1
  Status
  affected
  Constraints
  -
- Version
  6.2.19
  Status
  affected
  Constraints
  -
- Version
  6.2.5
  Status
  affected
  Constraints
  -
- Version
  6.2.9
  Status
  affected
  Constraints
  -
- Version
  6.3.1
  Status
  affected
  Constraints
  -
- Version
  6.3.3
  Status
  affected
  Constraints
  -
- Version
  6.3.5
  Status
  affected
  Constraints
  -
- Version
  6.3.7
  Status
  affected
  Constraints
  -
- Version
  7.0.5
  Status
  affected
  Constraints
  -
- Version
  7.1.1
  Status
  affected
  Constraints
  -
- Version
  7.1.5
  Status
  affected
  Constraints
  -
- Version
  7.2.11
  Status
  affected
  Constraints
  -
- Version
  7.2.13
  Status
  affected
  Constraints
  -
- Version
  7.2.3
  Status
  affected
  Constraints
  -
- Version
  7.2.5
  Status
  affected
  Constraints
  -
- Version
  7.2.7
  Status
  affected
  Constraints
  -
- Version
  7.3.3
  Status
  affected
  Constraints
  -
- Version
  7.3.5
  Status
  affected
  Constraints
  -
- Version
  8.1.5
  Status
  affected
  Constraints
  -
Vendor Cisco Product Cisco Secure Endpoint Private Cloud Console Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Secure Endpoint

n/a

Version	Status	Constraints
1.10.0	affected	-
1.10.1	affected	-
1.10.2	affected	-
1.11.0	affected	-
1.12.0	affected	-
1.12.1	affected	-
1.12.2	affected	-
1.12.3	affected	-
1.12.4	affected	-
1.12.5	affected	-
1.12.6	affected	-
1.12.7	affected	-
1.13.0	affected	-
1.13.1	affected	-
1.13.2	affected	-
1.14.0	affected	-
1.6.0	affected	-
1.7.0	affected	-
1.8.0	affected	-
1.8.1	affected	-
1.8.4	affected	-
1.9.0	affected	-
1.9.1	affected	-
6.0.7	affected	-
6.0.9	affected	-
6.1.5	affected	-
6.1.7	affected	-
6.1.9	affected	-
6.2.1	affected	-
6.2.19	affected	-
6.2.5	affected	-
6.2.9	affected	-
6.3.1	affected	-
6.3.3	affected	-
6.3.5	affected	-
6.3.7	affected	-
7.0.5	affected	-
7.1.1	affected	-
7.1.5	affected	-
7.2.11	affected	-
7.2.13	affected	-
7.2.3	affected	-
7.2.5	affected	-
7.2.7	affected	-
7.3.3	affected	-
7.3.5	affected	-
8.1.5	affected	-

Cisco

Cisco Secure Endpoint Private Cloud Console

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Metrics

1.17% 0.01171

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01171

Score over time

2023–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.17% (0.01171)	66.33th	v5 (v2026.06.15)
Jun 15, 2026	0.88% (0.00883)	54.29th	v5 (v2026.06.15)
Mar 30, 2025	0.97% (0.00975)	74.66th	v4 (v2025.03.14)
Mar 29, 2025	3.53% (0.03528)	79.19th	v4 (v2025.03.14)
Mar 28, 2025	1.17% (0.01168)	76.71th	v4 (v2025.03.14)
Mar 27, 2025	3.53% (0.03528)	86.09th	v4 (v2025.03.14)
Mar 25, 2025	1.17% (0.01168)	76.60th	v4 (v2025.03.14)
Mar 24, 2025	3.53% (0.03528)	86.54th	v4 (v2025.03.14)
Mar 17, 2025	1.23% (0.01228)	77.77th	v4 (v2025.03.14)
Dec 12, 2024	0.12% (0.00118)	47.53th	v3 (v2023.03.01)
Jul 16, 2024	0.07% (0.00075)	32.50th	v3 (v2023.03.01)
Jun 28, 2024	0.06% (0.00063)	27.02th	v3 (v2023.03.01)
Jan 31, 2024	0.06% (0.00063)	25.00th	v3 (v2023.03.01)
Aug 27, 2023	0.08% (0.00084)	34.63th	v3 (v2023.03.01)
Aug 26, 2023	0.06% (0.00063)	24.87th	v3 (v2023.03.01)
Aug 18, 2023	0.05% (0.00048)	14.77th	v3 (v2023.03.01)

Weaknesses (1)

CWE-835

References (1)

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-rNwNEEee
Vendor Advisory

Link	Providers	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-rNwNEEee		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner cisco

Published Aug 16, 2023

Updated Aug 2, 2024

Reserved Oct 27, 2022

Link CVE-2023-20197

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-20197

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-20197