CVE-2026-20216

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

• SECURITY UPDATE: Out-of-bounds write via 7z substream count overflow
  • debian/patches/CVE-2026-20215.patch: reject 7z archives whose total unpack-stream count would overflow UInt32 before it is accumulated in libclamav/7z/7zIn.c
  • CVE-2026-20215
• SECURITY UPDATE: Denial of service via InstallShield extraction size-limit bypass
  • debian/patches/CVE-2026-20216.patch: enforce maxfilesize and maxscansize against the cumulative inflated output and propagate hard-stop limit errors out of is_extract_cab() in libclamav/ishield.c
  • CVE-2026-20216
• SECURITY UPDATE: Invalid free in the PESpin unpacker cleanup loop
  • debian/patches/CVE-2026-20217.patch: shift the working bitmap instead of bitman in the PESpin cleanup loop so only unpacker-allocated sections are freed in libclamav/spin.c
  • CVE-2026-20217

• CVE-2026-20213: fix Aspack-triggered PE rebuild integer overflow leading to heap buffer overflow write
• CVE-2026-20214: fix FSG unpacker section loop underflow leading to out-of-bounds write
• CVE-2026-20215: fix 7z substream count overflow leading to heap under-allocation and out-of-bounds write
• CVE-2026-20216: enforce InstallShield extraction limits to prevent temporary storage exhaustion
• CVE-2026-20217: fix PESpin unpacker cleanup bitmap tracking leading to invalid free and crash
• CVE-2026-20243: fix ALZ archive parser out-of-bounds write and scan-limit bypass

• CVE-2026-20213: fix Aspack-triggered PE rebuild integer overflow leading to heap buffer overflow write
• CVE-2026-20214: fix FSG unpacker section loop underflow leading to out-of-bounds write
• CVE-2026-20215: fix 7z substream count overflow leading to heap under-allocation and out-of-bounds write
• CVE-2026-20216: enforce InstallShield extraction limits to prevent temporary storage exhaustion
• CVE-2026-20217: fix PESpin unpacker cleanup bitmap tracking leading to invalid free and crash

The updated packages fix security vulnerabilities: PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability. (CVE-2026-20213) FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability. (CVE-2026-20214) 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability. (CVE-2026-20215) InstallShield File Format Processing Resource Exhaustion Vulnerability. (CVE-2026-20216) PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability. (CVE-2026-20217) ALZ Archive Processing Denial of Service Vulnerability. (CVE-2026-20243) DMG File Processing Denial of Service Vulnerability. (CVE-2026-20244)

These are all security issues fixed in the clamav-1.5.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

Update to version 1.5.3.

Security issues fixed:

• CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning (bsc#1270107).
• CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning (bsc#1270085).
• CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning (bsc#1270088).
• CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning (bsc#1270089).
• CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning (bsc#1270091).
• CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning (bsc#1270092).
• CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning (bsc#1270106).
• CVE-2026-41676: buffer overflow due to missing checks via Deriver:derive, PkeyCtxRef:derive and OpenSSL 1.1.1 (bsc#1270138).

Other updates and bugfixes:

• Version 1.5.3:

• Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.
• Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.
• Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.
• Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.
• Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.
• Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.
• Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.
• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to resolve CVE-2026-41676.
• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
• Metadata preclass scans now run before the final scan verdict.
• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for clamav fixes the following issues:

Update to version 1.5.3.

Security issues fixed:

• CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning (bsc#1270107).
• CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning (bsc#1270085).
• CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning (bsc#1270088).
• CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning (bsc#1270089).
• CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning (bsc#1270091).
• CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning (bsc#1270092).
• CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning (bsc#1270106).
• CVE-2026-41676: buffer overflow due to missing checks via Deriver:derive, PkeyCtxRef:derive and OpenSSL 1.1.1 (bsc#1270138).

Other updates and bugfixes:

• Version 1.5.3:

• Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.
• Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.
• Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.
• Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.
• Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.
• Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.
• Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.
• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to resolve CVE-2026-41676.
• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
• Metadata preclass scans now run before the final scan verdict.
• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for clamav fixes the following issues

• CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270107).
• CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270085).
• CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270088).
• CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270089).
• CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270091).
• CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270092).
• CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service on 32-bit platforms only (bsc#1270106).
• CVE-2026-41676: rust-openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270138).

Changes for clamav:

• Update to 1.5.3:

  • Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
  • Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
  • Metadata preclass scans now run before the final scan verdict.
  • ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
  • ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for clamav fixes the following issues

• CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270107).
• CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270085).
• CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270088).
• CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270089).
• CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270091).
• CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270092).
• CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service on 32-bit platforms only (bsc#1270106).
• CVE-2026-41676: rust-openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270138).

Changes for clamav:

• Update to 1.5.3:

  • Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
  • Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
  • Metadata preclass scans now run before the final scan verdict.
  • ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
  • ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for clamav fixes the following issues

• CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270107).
• CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270085).
• CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270088).
• CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270089).
• CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270091).
• CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270092).
• CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service on 32-bit platforms only (bsc#1270106).
• CVE-2026-41676: rust-openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270138).

Changes for clamav:

• Update to 1.5.3:

  • Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
  • Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
  • Metadata preclass scans now run before the final scan verdict.
  • ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
  • ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

This update for clamav fixes the following issues

• CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270107).
• CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270085).
• CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270088).
• CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270089).
• CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270091).
• CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service (bsc#1270092).
• CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service on 32-bit platforms only (bsc#1270106).
• CVE-2026-41676: rust-openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270138).

Changes for clamav:

• update to 1.5.3:

• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.
• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.
• Metadata preclass scans now run before the final scan verdict.
• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20213, CVE-2026-20214, CVE-2026-20217)

It was discovered that ClamAV incorrectly handled certain 7z archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20215)

It was discovered that ClamAV incorrectly handled extraction limits for certain InstallShield archives. A remote attacker could possibly use this issue to cause ClamAV to use excessive resources, leading to a denial of service. (CVE-2026-20216)

It was discovered that ClamAV incorrectly handled certain ALZ archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20243)

It was discovered that ClamAV incorrectly handled certain DMG files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20244)