Description
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canimaan Software | ClamXAV | 3.3 – < 3.11.1 | 3.11.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | clamav | No fix yet | — |
Advisories 1
- VA-26-278-01 Canimaan Software ClamXAV local privilege escalation CISA ICS & IT advisories · Oct 5, 2026