Description
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.92~dfsg-1~volatile2 | — |
| Debian 13 | clamav | 0.92~dfsg-1~volatile2 | — |
| Debian 12 | clamav | 0.92~dfsg-1~volatile2 | — |
| Debian 5.0 | clamav | 0.91.2-4.0lenny1 | DTSA-101-1 |
| Debian 4.0 | clamav | 0.90.1-3etch8 | DSA-1435-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.3-1.4 | openSUSE-SU-2024:10685-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- ClamAV 0.91.2 - libclamav MEW PE Buffer Overflow EDB-4862 · remote · Jan 7, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1435-1 clamav Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-101-1 clamav - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10685-1 clamav-0.103.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 20071218 ClamAV libclamav MEW PE File Integer Overflow Vulnerability third-party-advisory
- MDVSA-2008:003 vendor-advisory
- 26927 vdb-entry
- DSA-1435 vendor-advisory
- 28412 third-party-advisory
- ADV-2008-0924 vdb-entry
- FEDORA-2008-0170 vendor-advisory
- 1019112 vdb-entry
- clamantivirus-libclamav-mewpe-bo(39119) vdb-entry
- 28421 third-party-advisory
- 29420 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- FEDORA-2008-0115 vendor-advisory
- 28176 third-party-advisory
- 28587 third-party-advisory
- 28153 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- GLSA-200712-20 vendor-advisory
- 4862 exploit
- 28117 third-party-advisory
- ADV-2007-4253 vdb-entry
- 28278 third-party-advisory
- SUSE-SR:2008:001 vendor-advisory