Summary
It was discovered that ClamAV incorrectly handled certain PE files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2026-20213, CVE-2026-20214,
CVE-2026-20217)
It was discovered that ClamAV incorrectly handled certain 7z archive
files. A remote attacker could possibly use this issue to cause ClamAV to
crash, resulting in a denial of service. (CVE-2026-20215)
It was discovered that ClamAV incorrectly handled extraction limits for
certain InstallShield archives. A remote attacker could possibly use this
issue to cause ClamAV to use excessive resources, leading to a denial of
service. (CVE-2026-20216)
It was discovered that ClamAV incorrectly handled certain ALZ archive
files. A remote attacker could possibly use this issue to cause ClamAV to
crash, resulting in a denial of service. (CVE-2026-20243)
It was discovered that ClamAV incorrectly handled certain DMG files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2026-20244)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | clamav | 1.5.3+dfsg-0ubuntu0.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | clamav | 1.5.3+dfsg-0ubuntu0.24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | clamav | 1.5.3+dfsg-0ubuntu0.26.04.1 |
Vulnerabilities 7
-
High 7.5
ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper …
-
High 7.5
ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper…
-
High 7.5
ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper …
-
High 7.5
ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability
A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An at…
-
High 7.5CVE-2026-20217 Public exploit
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to impro…
-
High 7.5
ClamAV ALZ Archive Processing Denial of Service Vulnerability
A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper…
-
High 7.5
ClamAV DMG File Processing Denial of Service Vulnerability
A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper…
References
-
report
https://ubuntu.com/security/CVE-2026-20213
-
report
https://ubuntu.com/security/CVE-2026-20214
-
report
https://ubuntu.com/security/CVE-2026-20215
-
report
https://ubuntu.com/security/CVE-2026-20216
-
report
https://ubuntu.com/security/CVE-2026-20217
-
report
https://ubuntu.com/security/CVE-2026-20243
-
report
https://ubuntu.com/security/CVE-2026-20244