Skip to main content

ClamAV CVE-2026-20244

| EUVDEUVD-2026-41084 HIGH
Classic Buffer Overflow (CWE-120)
2026-07-01 psirt@cisco.com GHSA-7wm4-rx33-g4hj
Buffer Overflow Secure Endpoint Clamav Red Hat Suse
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable via scan input with no auth or interaction, but AC:H because exploitation depends on the target running a 32-bit build; availability-only impact so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 17:39 vuln.today

DescriptionCVE.org

A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning engine by submitting a crafted Apple Disk Image (DMG) for inspection. The flaw stems from an integer overflow triggered during boundary checks on DMG content and manifests only on 32-bit builds of ClamAV; memory corruption raises the theoretical possibility of expanded impact beyond a crash, though only DoS is described. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

ClamAV is a widely used open-source antivirus engine (maintained by Cisco Talos) that unpacks and scans many container and archive formats, including Apple DMG disk images. The vulnerability lives in the DMG parser (libclamav), where improper boundary validation of DMG content leads to an integer overflow when computing sizes/offsets. On 32-bit platforms the smaller native integer width causes the arithmetic to wrap, producing an out-of-bounds condition and memory corruption. This maps to CWE-120 (Buffer Copy without Checking Size of Input / classic buffer overflow); the root cause is unchecked size arithmetic feeding a copy or indexing operation, a common failure mode in format parsers that trust attacker-controlled length fields.

RemediationAI

Upgrade to a fixed ClamAV release as identified in the Cisco/Talos advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR); an exact patched version was not included in the provided data, so confirm the fixed build from that advisory before deploying - no vendor-released patch version is independently confirmed here. As a targeted compensating control, disable DMG scanning where the format is not needed by setting ScanArchive/format-specific handling appropriately in clamd.conf (trade-off: DMG-borne malware would no longer be inspected). Where feasible, run ClamAV as a 64-bit build, which is not affected by the described 32-bit integer overflow (trade-off: requires a platform/package change). Additionally, isolate the scanning process (resource limits, automatic restart via a supervisor) so a crash degrades gracefully rather than halting the scanning pipeline, and restrict which untrusted sources can submit files for scanning.

More in Secure Endpoint

View all
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2026-20214 HIGH
7.5 Jul 01

Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning eng
CVE-2026-20213 HIGH
7.5 Jul 01

Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash
CVE-2026-20243 HIGH
7.5 Jul 01

Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine
CVE-2026-20217 HIGH
7.5 Jul 01

Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker
CVE-2026-20216 HIGH
7.5 Jul 01

Denial of service in ClamAV's InstallShield file format parser allows a remote, unauthenticated attacker (per CVSS PR:N)
CVE-2026-20215 HIGH
7.5 Jul 01

Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process
CVE-2023-20212 HIGH
7.5 Aug 18

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of serv
CVE-2023-20197 HIGH
7.5 Aug 16

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthe
CVE-2022-20785 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20771 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20770 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-20244 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy