PT-2026-54703 · Clamav · Clamav

David Pokora + 1 · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-20213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ClamAV (affected versions not specified)

Description An issue exists in the PE file format parser where improper boundary checks for content during scanning can lead to an out-of-bounds buffer write. A remote, unauthenticated attacker can exploit this by submitting a specially crafted file containing PE content. This memory corruption may cause the scanning process to terminate, resulting in a Denial of Service (DoS) condition, or potentially other expanded impacts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2026-20213

Affected Products

Clamav

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-20213 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR · Vendor Advisory
• https://twitter.com/KaitanSecurity/status/2072372176733274502 · Twitter Post
• https://twitter.com/techepages/status/2072614506300420195 · Twitter Post