CVE-2026-20348

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

An indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. (CVE-2026-20345) An integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. (CVE-2026-20339) An integer underflow in the PDF parser that could cause a crash while reading a malformed hex string. (CVE-2026-20346) Undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file. (CVE-2026-20347) XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents. (CVE-2026-20348)

These are all security issues fixed in the clamav-1.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: ejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

This update for clamav fixes the following issues:

• CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
• CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598).
• CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599).
• CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600).
• CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
• CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).
• CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit bypass (bsc#1274603).
• CVE-2026-46671: onenote_parser: Path traversal in Parser:parse_notebook allows reading files outside the notebook directory (bsc#1271922).
• CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

Changes for clamav:

Update to 1.5.4:

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.
• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.
• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.
• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

It was discovered that ClamAV incorrectly handled certain zip archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20337, CVE-2026-20338)

It was discovered that ClamAV incorrectly handled certain PESpin files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20339)

It was discovered that ClamAV incorrectly handled certain GPT files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20345)

It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20346)

It was discovered that ClamAV incorrectly handled certain Mach-O files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20347)

It was discovered that ClamAV incorrectly handled certain XAR files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20348)