CVE-2020-9320: Avira Anti-Malware SDK

Medium severity, CVSS 5.5. EPSS: 2.9% chance of exploitation in the next 30 days.

Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, Antivirus for Small Business, Exchange Security (Gateway), Internet Security Suite for Windows, Prime, Free Security Suite for Windows, and Cross Platform Anti-malware SDK. NOTE: Vendor asserts that vulnerability does not exist in product

Affected products

• Avira Anti-Malware SDK: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Antivirus Server: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Antivirus For Endpoint: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Antivirus For Small Business: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Exchange Security: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Free Security Suite: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Internet Security Suite: before 8.3.54.138 (fixed in 8.3.54.138)
• Avira Avira Prime: before 8.3.54.138 (fixed in 8.3.54.138)

Published 2020-02-20. Last modified 2026-06-17.