Description
The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clamav | 0.97.5+dfsg-1 | — |
| Debian 13 | clamav | 0.97.5+dfsg-1 | — |
| Debian 12 | clamav | 0.97.5+dfsg-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.99.2-4.1 | openSUSE-SU-2024:10571-1 |
Advisories 1
- openSUSE-SU-2024:10571-1 clamav-0.99.2-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2012:0833 vendor-advisory
- 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products mailing-list
- 52611 vdb-entry
- 80473 vdb-entry
- http://www.ieee-security.org/TC/SP2012/program.html
- multiple-av-chm-header-evasion(74301) vdb-entry
- 80474 vdb-entry
- MDVSA-2012:094 vendor-advisory