A critical code injection vulnerability in the ClamAV ClamBC bytecode interpreter allows unauthenticated attackers to execute malicious code via manipulated function names.

The vulnerability exists in the ClamBC bytecode interpreter due to improper input validation during function name processing. This allows an attacker to inject and execute malicious bytecode within the engine.

Exploitation of this vulnerability allows for arbitrary code execution, which can lead to full system compromise if the ClamAV process is running with elevated privileges. Given the CVSS score of 9.8, this poses a severe threat to any infrastructure relying on ClamAV for malware scanning and perimeter security.

Immediate Action: Upgrade all instances of ClamAV to version 0.103.0-rc or later to ensure the bytecode interpreter is properly secured.

Proactive Monitoring: Review system logs for signs of anomalous ClamAV process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Isolate scanning engines within restricted environments (sandboxing) to limit the potential impact of a successful remote code execution attack.

Public Exploit Available: Yes — an exploit entry exists on ExploitDB.

Organizations must prioritize updating their ClamAV installations immediately. The combination of a critical CVSS score and existing public exploit code necessitates an urgent response to prevent potential system-wide compromise.