Netskope Threat Labs

FILE-OFFICE ClamAV OLE2 file parsing denial of service attempt

IPS-SWG

1 SID: 62972

Detects a Microsoft Office compound document exploiting CVE-2024-20290, a flaw that crashes the ClamAV antivirus engine while it scans the file. The crafted OLE2 structure exhausts parser resources, blinding the scanning layer rather than the victim application.