PatchTheCVECVE-2017-12377: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticate
CVE-2017-12377 is a critical-severity flaw (CVSS 9.8) affecting debian linux, clamav. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap-based buffer over-read condition in mew.c when ClamAV
Why this priority
- Critical severity
- EPSS top 4%: very likely to be exploited
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 11.6% (top 4%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2018-01-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Write-up: bugzilla.clamav.net/show_bug.cgi?id=11943
- Write-up: usn.ubuntu.com/3550-1/
- Write-up: usn.ubuntu.com/3550-2/
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-12377?
debian linux: mitigate or apply the listed mitigation; clamav: upgrade to newer than 0.99.2. Exact commands for each OS are on this page.
Is CVE-2017-12377 being exploited?
CVE-2017-12377 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-12377 affect?
CVE-2017-12377 affects debian linux, clamav. Severity is critical (CVSS 9.8). ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The v
How urgent is CVE-2017-12377?
Priority 76/100. Critical severity; EPSS top 4%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2023-42756 MEDIUM 4.4 UPGRADE MITIGATE A flaw was found in the Netfilter subsystem of the Linux kernel
- CVE-2023-39417 HIGH 7.5 UPGRADE MITIGATE IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extsche
- CVE-2026-111497 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Google Brotli Unchecked Return Value Vulnerability
- CVE-2025-38728 CRITICAL 9.1 UPGRADE MITIGATE In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount
- CVE-2025-38204 HIGH 7.8 UPGRADE MITIGATE In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read i