CVE-2022-20785: 
Clam AntiVirus vulnerability analysis and mitigation

A vulnerability (CVE-2022-20785) was discovered in the HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. The vulnerability was disclosed on April 20, 2022, affecting ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier (Cisco Advisory).

The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) with a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue stems from a memory leak in the HTML file parser component (NVD).

This vulnerability could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device (Cisco Advisory).

The vulnerability requires no authentication or user interaction to exploit, as indicated by the CVSS metrics (PR:N/UI:N). The Cisco Product Security Incident Response Team reported no known public announcements or malicious use of the vulnerability at the time of disclosure (Cisco Advisory).

No workarounds are available for this vulnerability. The issue has been fixed in ClamAV version 0.103.6 for the LTS branch and version 0.104.3 for the main branch. Users are advised to upgrade to these or later versions (Cisco Advisory).