Skip to main content

ClamAV CVE-2026-57226

MEDIUM
2026-09-14 vendor:ubuntu
Share

Severity by source

vuln.today AI
8.1 HIGH

Network-reachable via automatic file scanning (AV:N, PR:N, UI:N); AC:H because heap exploitation against modern mitigations requires non-trivial effort despite trivial delivery.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

2
Analysis Generated
Sep 14, 2026 - 09:10 vuln.today
CVE Published
Sep 14, 2026 - 00:00 cve.org
MEDIUM

DescriptionCVE.org

[detect/file_data: heap buffer overflow in SWF decompression depth handling]

AnalysisAI

Heap buffer overflow in SWF (Shockwave Flash) decompression depth handling affects a file analysis engine - most likely ClamAV, based on the 'detect/file_data' module path and Ubuntu as the reporting vendor. An attacker can supply a specially crafted SWF file that, when scanned, triggers out-of-bounds writes on the heap during recursive or depth-tracked decompression, potentially leading to process crash or arbitrary code execution within the scanning daemon. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation Exploitation requires that the affected file analysis engine (likely ClamAV) is configured to scan SWF files - which is the default behavior for most deployments processing untrusted content. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Available signals are severely limited: no CVSS vector, no CWE, no EPSS score, no KEV status, no POC, and no patch version are provided. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch is identified at time of analysis - no fix version, no advisory URL, and no upstream commit reference are included in the input data. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-57226 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy