The vulnerability arises from misconfigured documentation instructions that expose ClamAV daemon ports 3310 and 7357 to the internet. A remote attacker who can reach these exposed ports can submit exceptionally large or maliciously constructed documents to the ClamAV daemon, draining server resources or triggering a termination of the clamd process, thereby disabling document scanning and disrupting classroom sessions. The flaw is a configuration error, classified under CWE-668: Improper Control of a Resource Through an Untrusted Source.

The issue affects installations of BigBlueButton version 3.0.21 and earlier that adopted the extra configuration steps described in the official Server Customization guide. Systems that did not enable the optional ClamAV integration remain unaffected. The vulnerability involves the Docker image used by BigBlueButton, where the container exposes the ClamAV daemon ports to the external network and mounts the host’s /var/bigbluebutton directory with write access inside the container, potentially allowing future exploitation of clamd files.

The CVSS score of 7.2 indicates a high severity of denial‑of‑service impact. The EPSS score is below 1 %, suggesting the probability of exploitation is low but not zero. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network reachability to the compromised ports, which by design are reachable from the public internet in the affected configuration. Given the simplicity of connecting to a TCP port and sending data, attackers can repeatedly trigger service degradation without needing privileged credentials.