By vendor

Clamav vulnerabilities

Known CVEs affecting Clamav products, prioritized by severity, with SEC.co remediation and detection guidance.

7 published vulnerabilities

• CVE-2026-20213HIGH 7.5

  ClamAV, a widely-used open-source antivirus engine, contains a flaw in how it processes PE (Portable Executable) files during scanning. An attacker can craft a malicious PE file that, when scanned, causes ClamAV to crash due to improper memory handling. This disrupts the scanning service and prevents legitimate threat detection from functioning. While the primary impact is denial of service, the underlying memory corruption could potentially enable more severe attacks depending on how the vulnerability is exploited.

• CVE-2026-20214HIGH 7.5

  ClamAV, a widely deployed open-source antivirus engine used in products like Cisco Secure Endpoint, contains a flaw in how it parses FSG-compressed executable files. An attacker can craft a malicious FSG file that triggers an out-of-bounds memory write when scanned, crashing the scanning process and disrupting threat detection. This is a network-reachable denial-of-service vulnerability requiring no authentication or user interaction.

• CVE-2026-20215HIGH 7.5

  ClamAV, an open-source antivirus engine widely integrated into Cisco Secure Endpoint and other security products, contains a flaw in how it parses 7z compressed files. When scanning a specially crafted 7z file, the parser fails to properly validate memory boundaries, allowing an attacker to write data outside allocated buffer space. This memory corruption causes the ClamAV scanning process to crash, disrupting antivirus protection on affected systems. An attacker needs only to submit a malicious 7z file for scanning—no authentication or user interaction required—making this a remote denial-of-service threat to organizations relying on ClamAV for file scanning.

• CVE-2026-20216HIGH 7.5

  ClamAV, an open-source antivirus engine widely deployed in enterprise environments, contains a flaw in how it parses InstallShield installer files. When ClamAV scans a specially crafted InstallShield file, the parser mismanages temporary resources, causing the scanning process to crash and consuming system memory and CPU in the process. An attacker can trigger this remotely by uploading or submitting a malicious file to any system running ClamAV, resulting in service disruption without needing credentials or user interaction.

• CVE-2026-20217HIGH 7.5

  ClamAV's PESpin file format parser contains a memory safety flaw that allows remote attackers to crash the scanning engine by submitting a specially crafted file. When ClamAV processes the malicious file, improper boundary validation causes a buffer to be written beyond its allocated memory, terminating the scanner and disrupting security operations. The attacker needs only network access and no credentials; the vulnerable software will automatically process the file if scanned.

• CVE-2026-20243HIGH 7.5

  ClamAV's parser for ALZ archive files contains a flaw that fails to properly validate file boundaries during scanning. This allows an attacker to craft a malicious ALZ file that, when scanned, causes the antivirus engine to write data outside allocated memory regions. The result is typically a crash of the scanning process, disrupting the ability of the affected system to scan files until the service is restarted. While the vulnerability is currently characterized as causing denial of service, memory corruption of this nature can sometimes enable deeper system compromise depending on the specifics of exploitation.

• CVE-2026-20244HIGH 7.5

  ClamAV's DMG file parser contains a flaw that allows remote attackers to crash the scanning engine by submitting specially crafted DMG archive files. The vulnerability stems from inadequate boundary validation when processing DMG content, leading to integer overflow on 32-bit systems. An attacker needs only to send a malicious DMG file to a ClamAV instance; no authentication or user interaction is required. Successful exploitation terminates the scanning process, effectively disabling antivirus protection on the affected device until the service restarts.