{"id":"CVE-2026-20216","aliases":["ALPINE-CVE-2026-20216","AZL-92172","CLSA-2026-1784210640","CLSA-2026-1786831629","CLSA-2026-1787337364","DEBIAN-CVE-2026-20216","EUVD-2026-41081","GHSA-8fx8-2p33-gv76","MGASA-2026-0271","SUSE-SU-2026:22574-1","SUSE-SU-2026:2833-1","SUSE-SU-2026:2834-1","SUSE-SU-2026:2834-2","SUSE-SU-2026:2835-1","UBUNTU-CVE-2026-20216","USN-8517-1","openSUSE-SU-2026:11182-1","openSUSE-SU-2026:21252-1"],"status":"published","title":"ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00573,"percentile":0.47688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-07-01T16:27:51Z","modified":"2026-11-03T06:33:01Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"clamav","fixed_in":["1.4.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"clamav","fixed_in":["1.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"clamav","fixed_in":["1.4.6+dfsg-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"clamav","fixed_in":["1.4.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"clamav","fixed_in":["1.5.3+dfsg-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"clamav","fixed_in":["1.5.3+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"clamav","fixed_in":["1.5.3+dfsg-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.4.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamav-testfiles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"clamdscan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libclamav12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg-0ubuntu0.18.04.1+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el6.tuxcare.els2"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-freshclam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamav-milter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"clamd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.3-1.el7.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6+dfsg-0+deb12u1"}]}],"versions":["1.0.1+dfsg-2","1.0.2+dfsg-1","1.0.2+dfsg-1~deb12u1","1.0.3+dfsg-1","1.0.3+dfsg-1~deb12u1","1.0.3+dfsg-2","1.0.4+dfsg-1","1.0.5+dfsg-1","1.0.5+dfsg-1.1","1.0.5+dfsg-1~deb12u1","1.0.6+dfsg-1","1.0.7+dfsg-1~deb11u1","1.0.7+dfsg-1~deb11u2","1.0.7+dfsg-1~deb12u1","1.0.9+dfsg-1~deb11u1","1.0.9+dfsg-1~deb12u1","1.2.1+dfsg-1","1.2.1+dfsg-2","1.2.1+dfsg-3","1.3.1+dfsg-1","1.3.1+dfsg-2","1.3.1+dfsg-3","1.3.1+dfsg-4","1.3.1+dfsg-5","1.4.1+dfsg-1","1.4.2+dfsg-1","1.4.3+dfsg-1","1.4.3+dfsg-1~deb11u1","1.4.3+dfsg-1~deb12u1","1.4.3+dfsg-1~deb12u2","1.4.3+dfsg-2","1.4.4+dfsg-1","1.4.4+dfsg-2","1.4.5+dfsg-1","1.4.5+dfsg-2","1.4.5+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3+dfsg-1","1.4.3+dfsg-2","1.4.4+dfsg-1","1.4.4+dfsg-2","1.4.5+dfsg-1","1.4.5+dfsg-2","1.4.5+dfsg-3","1.4.6+dfsg-1","1.4.6+dfsg-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5+dfsg-1"}]}],"versions":["1.4.3+dfsg-1","1.4.3+dfsg-2","1.4.4+dfsg-1","1.4.4+dfsg-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1.mga10"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.56.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-3.56.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150400.13.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150600.18.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.8+dfsg-1ubuntu4","0.97.8+dfsg-1ubuntu5","0.98.1+dfsg-1ubuntu4","0.98.1+dfsg-1ubuntu5","0.98.1+dfsg-2ubuntu2","0.98.1+dfsg-4ubuntu1","0.98.1+dfsg-4ubuntu1.1","0.98.5+addedllvm-0ubuntu0.14.04.1","0.98.6+dfsg-0ubuntu0.14.04.1","0.98.7+dfsg-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.1","0.99.2+addedllvm-0ubuntu0.14.04.2","0.99.3+addedllvm-0ubuntu0.14.04.1","0.99.4+addedllvm-0ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.1","0.100.1+dfsg-1ubuntu0.14.04.2","0.100.1+dfsg-1ubuntu0.14.04.3","0.100.1+dfsg-1ubuntu0.14.04.4","0.100.2+dfsg-1ubuntu0.14.04.1","0.100.2+dfsg-1ubuntu0.14.04.2","0.100.3+dfsg-0ubuntu0.14.04.1","0.100.3+dfsg-0ubuntu0.14.04.1+esm1","0.101.4+dfsg-0ubuntu0.14.04.1+esm1","0.102.1+dfsg-0ubuntu0.14.04.1+esm1","0.102.2+dfsg-0ubuntu0.14.04.1+esm1","0.102.3+dfsg-0ubuntu0.14.04.1+esm1","0.102.4+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm1","0.103.2+dfsg-0ubuntu0.14.04.1+esm2","0.103.5+dfsg-0ubuntu0.14.04.1+esm1","0.103.6+dfsg-0ubuntu0.14.04.1+esm1","0.103.8+dfsg-0ubuntu0.14.04.1+esm1","0.103.9+dfsg-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.7+dfsg-0ubuntu4","0.98.7+dfsg-0ubuntu5","0.99+dfsg-1ubuntu1","0.99+dfsg-1ubuntu1.1","0.99+dfsg-1ubuntu1.2","0.99.2+dfsg-0ubuntu0.16.04.1","0.99.2+dfsg-0ubuntu0.16.04.2","0.99.2+dfsg-0ubuntu0.16.04.3","0.99.3+addedllvm-0ubuntu0.16.04.1","0.99.4+addedllvm-0ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.1","0.100.1+dfsg-1ubuntu0.16.04.2","0.100.1+dfsg-1ubuntu0.16.04.3","0.100.2+dfsg-1ubuntu0.16.04.1","0.100.3+dfsg-0ubuntu0.16.04.1","0.101.4+dfsg-0ubuntu0.16.04.1","0.102.1+dfsg-0ubuntu0.16.04.2","0.102.2+dfsg-0ubuntu0.16.04.1","0.102.3+dfsg-0ubuntu0.16.04.1","0.102.4+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1","0.103.2+dfsg-0ubuntu0.16.04.1+esm1","0.103.5+dfsg-0ubuntu0.16.04.1+esm1","0.103.6+dfsg-0ubuntu0.16.04.1+esm1","0.103.8+dfsg-0ubuntu0.16.04.1+esm1","0.103.9+dfsg-0ubuntu0.16.04.1+esm1","0.103.12+dfsg-0ubuntu0.16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.2+dfsg-6ubuntu2","0.99.3~beta1+dfsg-2ubuntu1","0.99.3~beta1+dfsg-2ubuntu2","0.99.3+addedllvm-0ubuntu1","0.99.3+addedllvm-0ubuntu2","0.99.4+addedllvm-0ubuntu1","0.100.1+dfsg-1ubuntu0.18.04.1","0.100.1+dfsg-1ubuntu0.18.04.2","0.100.1+dfsg-1ubuntu0.18.04.3","0.100.2+dfsg-1ubuntu0.18.04.1","0.100.3+dfsg-0ubuntu0.18.04.1","0.101.4+dfsg-0ubuntu0.18.04.1","0.102.1+dfsg-0ubuntu0.18.04.2","0.102.2+dfsg-0ubuntu0.18.04.1","0.102.3+dfsg-0ubuntu0.18.04.1","0.102.4+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.1","0.103.2+dfsg-0ubuntu0.18.04.2","0.103.2+dfsg-0ubuntu0.18.04.3","0.103.5+dfsg-0ubuntu0.18.04.1","0.103.6+dfsg-0ubuntu0.18.04.1","0.103.8+dfsg-0ubuntu0.18.04.1","0.103.9+dfsg-0ubuntu0.18.04.1+esm1","0.103.12+dfsg-0ubuntu0.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.101.4+dfsg-1ubuntu1","0.102.1+dfsg-1ubuntu1","0.102.1+dfsg-2ubuntu1","0.102.1+dfsg-2ubuntu2","0.102.2+dfsg-1ubuntu1","0.102.2+dfsg-2ubuntu1","0.102.3+dfsg-0ubuntu0.20.04.1","0.102.4+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.1","0.103.2+dfsg-0ubuntu0.20.04.2","0.103.5+dfsg-1~20.04.1","0.103.6+dfsg-0ubuntu0.20.04.1","0.103.8+dfsg-0ubuntu0.20.04.1","0.103.9+dfsg-0ubuntu0.20.04.1","0.103.11+dfsg-0ubuntu0.20.04.1","0.103.12+dfsg-0ubuntu0.20.04.1","1.4.3+dfsg-0ubuntu0.20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.22.04.2"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1","0.103.6+dfsg-0ubuntu0.22.04.1","0.103.8+dfsg-0ubuntu0.22.04.1","0.103.9+dfsg-0ubuntu0.22.04.1","0.103.11+dfsg-0ubuntu0.22.04.1","0.103.12+dfsg-0ubuntu0.22.04.1","1.4.3+dfsg-0ubuntu0.22.04.1","1.4.4+dfsg-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.24.04.1"}]}],"versions":["1.0.2+dfsg-1ubuntu1","1.0.3+dfsg-2ubuntu1","1.0.4+dfsg-0ubuntu1","1.0.5+dfsg-1ubuntu1","1.0.5+dfsg-1.1ubuntu2","1.0.5+dfsg-1.1ubuntu3","1.0.7+dfsg-0ubuntu0.24.04.1","1.0.8+dfsg-0ubuntu0.24.04.1","1.4.3+dfsg-0ubuntu0.24.04.1","1.4.4+dfsg-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2+dfsg-0ubuntu1","1.4.2+dfsg-0ubuntu2","1.4.2+dfsg-1ubuntu1","1.4.3+dfsg-0ubuntu1","1.4.3+dfsg-0ubuntu2","1.4.4+dfsg-0ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.26.04.1"}]}],"versions":["1.4.3+dfsg-0ubuntu2","1.4.3+dfsg-0ubuntu3","1.4.3+dfsg-2ubuntu1","1.4.3+dfsg-2ubuntu2","1.4.3+dfsg-2ubuntu3","1.4.4+dfsg-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.22.04.2"}]}],"versions":["0.103.3+dfsg-1","0.103.4+dfsg-1","0.103.4+dfsg-1build1","0.103.5+dfsg-1","0.103.6+dfsg-0ubuntu0.22.04.1","0.103.8+dfsg-0ubuntu0.22.04.1","0.103.9+dfsg-0ubuntu0.22.04.1","0.103.11+dfsg-0ubuntu0.22.04.1","0.103.12+dfsg-0ubuntu0.22.04.1","1.4.3+dfsg-0ubuntu0.22.04.1","1.4.4+dfsg-0ubuntu0.22.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.24.04.1"}]}],"versions":["1.0.2+dfsg-1ubuntu1","1.0.3+dfsg-2ubuntu1","1.0.4+dfsg-0ubuntu1","1.0.5+dfsg-1ubuntu1","1.0.5+dfsg-1.1ubuntu2","1.0.5+dfsg-1.1ubuntu3","1.0.7+dfsg-0ubuntu0.24.04.1","1.0.8+dfsg-0ubuntu0.24.04.1","1.4.3+dfsg-0ubuntu0.24.04.1","1.4.4+dfsg-0ubuntu0.24.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3+dfsg-0ubuntu0.26.04.1"}]}],"versions":["1.4.3+dfsg-0ubuntu2","1.4.3+dfsg-0ubuntu3","1.4.3+dfsg-2ubuntu1","1.4.3+dfsg-2ubuntu2","1.4.3+dfsg-2ubuntu3","1.4.4+dfsg-0ubuntu0.26.04.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-160000.1.1"}]}],"bundled":8}],"products":[{"vendor":"cisco","product":"cisco secure endpoint"},{"vendor":"cisco","product":"secure_endpoint"},{"vendor":"clamav","product":"clamav"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR","tags":["Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20216","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8fx8-2p33-gv76"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-20216","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784210640.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20217","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1786831629.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1787337364.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20214","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-20216","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0271.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35841","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N4HZVOZRQX4MIQVALYKDCGBZUHHVH4QN/","tags":["web"]},{"url":"https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.5","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622574-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270085","tags":["report"]},{"url":"https://bugzilla.suse.com/1270088","tags":["report"]},{"url":"https://bugzilla.suse.com/1270089","tags":["report"]},{"url":"https://bugzilla.suse.com/1270091","tags":["report"]},{"url":"https://bugzilla.suse.com/1270092","tags":["report"]},{"url":"https://bugzilla.suse.com/1270106","tags":["report"]},{"url":"https://bugzilla.suse.com/1270107","tags":["report"]},{"url":"https://bugzilla.suse.com/1270138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-20244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262833-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262834-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262834-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262835-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-20216","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-20216","tags":["report"]},{"url":"https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8517-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-20213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-20214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-20215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-20217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-20243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-20244","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-20216","title":"ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T16:27:51.314Z","modified":"2026-07-01T17:25:08.85Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:35:44.571002Z"}],"euvd":[{"id":"EUVD-2026-41081","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T16:27:51Z","modified":"2026-07-01T17:25:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:19.066641Z"}],"ghsa":[{"id":"GHSA-8fx8-2p33-gv76","title":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated,...","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\n\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T18:31:51Z","modified":"2026-07-01T18:31:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:09:09.679694Z"}],"nvd":[{"id":"CVE-2026-20216","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T17:16:29.973Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:27.199837Z"}],"osv":[{"id":"ALPINE-CVE-2026-20216","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T17:16:29.973Z","modified":"2026-11-03T06:33:01.711956638Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-20216","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T17:16:29.973Z","modified":"2026-10-27T07:19:32.263301598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-20216","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r \r This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T17:16:29.973Z","modified":"2026-10-26T11:47:35.738914291Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-20216","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-02T00:00:00Z","modified":"2026-07-09T17:15:51.081758505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"AZL-92172","title":"CVE-2026-20216 affecting package clamav for versions less than 1.5.3-1","description":"A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.","status":"published","published":"2026-07-01T17:16:29Z","modified":"2026-08-28T17:56:34.909933Z","updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"CLSA-2026-1784210640","title":"Fix CVE(s): CVE-2026-20215, CVE-2026-20216, CVE-2026-20217","description":"   * SECURITY UPDATE: Out-of-bounds write via 7z substream count overflow\n     - debian/patches/CVE-2026-20215.patch: reject 7z archives whose total\n       unpack-stream count would overflow UInt32 before it is accumulated in\n       libclamav/7z/7zIn.c\n     - CVE-2026-20215\n   * SECURITY UPDATE: Denial of service via InstallShield extraction size-limit bypass\n     - debian/patches/CVE-2026-20216.patch: enforce maxfilesize and maxscansize\n       against the cumulative inflated output and propagate hard-stop limit\n       errors out of is_extract_cab() in libclamav/ishield.c\n     - CVE-2026-20216\n   * SECURITY UPDATE: Invalid free in the PESpin unpacker cleanup loop\n     - debian/patches/CVE-2026-20217.patch: shift the working bitmap instead of\n       bitman in the PESpin cleanup loop so only unpacker-allocated sections are\n       freed in libclamav/spin.c\n     - CVE-2026-20217","status":"published","published":"2026-07-16T14:04:28Z","modified":"2026-10-26T09:31:47.205719224Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1786831629","title":"clamav: Fix of 6 CVEs","description":"- CVE-2026-20213: fix Aspack-triggered PE rebuild integer overflow leading to\n  heap buffer overflow write\n- CVE-2026-20214: fix FSG unpacker section loop underflow leading to\n  out-of-bounds write\n- CVE-2026-20215: fix 7z substream count overflow leading to heap\n  under-allocation and out-of-bounds write\n- CVE-2026-20216: enforce InstallShield extraction limits to prevent temporary\n  storage exhaustion\n- CVE-2026-20217: fix PESpin unpacker cleanup bitmap tracking leading to invalid\n  free and crash\n- CVE-2026-20243: fix ALZ archive parser out-of-bounds write and scan-limit\n  bypass","status":"published","published":"2026-08-15T22:07:17Z","modified":"2026-10-26T09:31:40.290793905Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787337364","title":"clamav: Fix of 5 CVEs","description":"- CVE-2026-20213: fix Aspack-triggered PE rebuild integer overflow leading to heap buffer overflow write\n- CVE-2026-20214: fix FSG unpacker section loop underflow leading to out-of-bounds write\n- CVE-2026-20215: fix 7z substream count overflow leading to heap under-allocation and out-of-bounds write\n- CVE-2026-20216: enforce InstallShield extraction limits to prevent temporary storage exhaustion\n- CVE-2026-20217: fix PESpin unpacker cleanup bitmap tracking leading to invalid free and crash","status":"published","published":"2026-08-21T18:36:17Z","modified":"2026-10-26T09:31:48.758023211Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0271","title":"Updated clamav packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nPE File Format Processing Out-of-Bounds Memory Corruption Vulnerability.\n(CVE-2026-20213)\nFSG File Format Processing Out-of-Bounds Memory Corruption\nVulnerability. (CVE-2026-20214)\n7Zip File Format Processing Out-of-Bounds Memory Corruption\nVulnerability. (CVE-2026-20215)\nInstallShield File Format Processing Resource Exhaustion Vulnerability.\n(CVE-2026-20216)\nPESpin File Format Processing Out-of-Bounds Memory Corruption\nVulnerability. (CVE-2026-20217)\nALZ Archive Processing Denial of Service Vulnerability. (CVE-2026-20243)\nDMG File Processing Denial of Service Vulnerability. (CVE-2026-20244)\n","status":"published","published":"2026-07-19T06:29:10Z","modified":"2026-07-19T06:30:04.906548226Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11182-1","title":"clamav-1.5.3-1.1 on GA media","description":"These are all security issues fixed in the clamav-1.5.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-04T00:00:00Z","modified":"2026-07-05T14:15:04.192907623Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21252-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nUpdate to version 1.5.3.\n\nSecurity issues fixed:\n\n- CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning\n  (bsc#1270107).\n- CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning\n  (bsc#1270085).\n- CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning\n  (bsc#1270088).\n- CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning\n  (bsc#1270089).\n- CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning\n  (bsc#1270091).\n- CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning\n  (bsc#1270092).\n- CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning\n  (bsc#1270106).\n- CVE-2026-41676: buffer overflow due to missing checks via `Deriver:derive`, `PkeyCtxRef:derive` and OpenSSL 1.1.1\n  (bsc#1270138).\n\nOther updates and bugfixes:\n\n- Version 1.5.3:\n * Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the\n   scanner.\n * Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE\n   file and lead to a heap buffer overflow write.\n * Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and\n   exhaust temporary storage.\n * Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.\n * Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip\n   expected scan-limit handling.\n * Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them\n   while reading a malformed archive.\n * Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit\n   scanner builds.\n * Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could\n   redirect copied, moved, or removed files under unsafe quarantine directory configurations.\n * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the\n   Rust openssl dependency to resolve CVE-2026-41676.\n * Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static\n   library dependencies.\n * Metadata preclass scans now run before the final scan verdict.\n * ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.\n * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.\n","status":"published","published":"2026-07-07T16:59:27Z","modified":"2026-07-09T10:00:10.943640114Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22574-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues:\n\nUpdate to version 1.5.3.\n\nSecurity issues fixed:\n\n- CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning\n  (bsc#1270107).\n- CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during scanning\n  (bsc#1270085).\n- CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during scanning\n  (bsc#1270088).\n- CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield file scanning\n  (bsc#1270089).\n- CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during scanning\n  (bsc#1270091).\n- CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during scanning\n  (bsc#1270092).\n- CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during scanning\n  (bsc#1270106).\n- CVE-2026-41676: buffer overflow due to missing checks via `Deriver:derive`, `PkeyCtxRef:derive` and OpenSSL 1.1.1\n  (bsc#1270138).\n\nOther updates and bugfixes:\n\n- Version 1.5.3:\n * Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the\n   scanner.\n * Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE\n   file and lead to a heap buffer overflow write.\n * Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and\n   exhaust temporary storage.\n * Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.\n * Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip\n   expected scan-limit handling.\n * Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them\n   while reading a malformed archive.\n * Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit\n   scanner builds.\n * Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could\n   redirect copied, moved, or removed files under unsafe quarantine directory configurations.\n * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the\n   Rust openssl dependency to resolve CVE-2026-41676.\n * Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static\n   library dependencies.\n * Metadata preclass scans now run before the final scan verdict.\n * ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.\n * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.\n","status":"published","published":"2026-07-07T16:57:40Z","modified":"2026-07-15T18:24:12.330896901Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2833-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues\n\n- CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270107).\n- CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270085).\n- CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270088).\n- CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of\n  service (bsc#1270089).\n- CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270091).\n- CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270092).\n- CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  on 32-bit platforms only (bsc#1270106).\n- CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270138).\n\nChanges for clamav:\n\n- Update to 1.5.3:\n    \n  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against\n    time-of-check/time-of-use races that could redirect copied, moved, or removed\n    files under unsafe quarantine directory configurations.\n  * Raised the minimum required CMake version to 3.17 to fix Linux builds with\n    libcurl v8.21.0 when linking static library dependencies.\n  * Metadata preclass scans now run before the final scan verdict.\n  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an\n    included path.\n  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide\n in the same bucket.\n","status":"published","published":"2026-07-09T19:10:57Z","modified":"2026-07-10T10:00:08.945516733Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2834-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues\n\n- CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270107).\n- CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270085).\n- CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270088).\n- CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of\n  service (bsc#1270089).\n- CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270091).\n- CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270092).\n- CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  on 32-bit platforms only (bsc#1270106).\n- CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270138).\n\nChanges for clamav:\n\n- Update to 1.5.3:\n    \n  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against\n    time-of-check/time-of-use races that could redirect copied, moved, or removed\n    files under unsafe quarantine directory configurations.\n  * Raised the minimum required CMake version to 3.17 to fix Linux builds with\n    libcurl v8.21.0 when linking static library dependencies.\n  * Metadata preclass scans now run before the final scan verdict.\n  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an\n    included path.\n  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide\n    in the same bucket.\n","status":"published","published":"2026-07-09T19:12:51Z","modified":"2026-07-10T10:00:07.774438614Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2834-2","title":"Security update for clamav","description":"This update for clamav fixes the following issues\n\n- CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270107).\n- CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270085).\n- CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270088).\n- CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of\n  service (bsc#1270089).\n- CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270091).\n- CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270092).\n- CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  on 32-bit platforms only (bsc#1270106).\n- CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270138).\n\nChanges for clamav:\n\n- Update to 1.5.3:\n    \n  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against\n    time-of-check/time-of-use races that could redirect copied, moved, or removed\n    files under unsafe quarantine directory configurations.\n  * Raised the minimum required CMake version to 3.17 to fix Linux builds with\n    libcurl v8.21.0 when linking static library dependencies.\n  * Metadata preclass scans now run before the final scan verdict.\n  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an\n    included path.\n  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide\n    in the same bucket.\n","status":"published","published":"2026-09-13T04:03:49Z","modified":"2026-09-17T18:23:12.719644065Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2835-1","title":"Security update for clamav","description":"This update for clamav fixes the following issues\n\n- CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270107).\n- CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270085).\n- CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270088).\n- CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to cause a denial of\n  service (bsc#1270089).\n- CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270091).\n- CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  (bsc#1270092).\n- CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial of service\n  on 32-bit platforms only (bsc#1270106).\n- CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270138).\n\nChanges for clamav:\n\n- update to 1.5.3:\n    \n * Hardened clamscan, clamdscan, and clamonacc quarantine actions against\n time-of-check/time-of-use races that could redirect copied, moved, or removed\n files under unsafe quarantine directory configurations.\n * Raised the minimum required CMake version to 3.17 to fix Linux builds with\n libcurl v8.21.0 when linking static library dependencies.\n * Metadata preclass scans now run before the final scan verdict.\n * ClamOnAcc: Fixed errors when recursively excluded paths are children of an\n included path.\n * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide\n in the same bucket.\n","status":"published","published":"2026-07-09T19:13:18Z","modified":"2026-07-10T10:00:09.066289728Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8517-1","title":"clamav vulnerabilities","description":"It was discovered that ClamAV incorrectly handled certain PE files. A\nremote attacker could possibly use this issue to cause ClamAV to crash,\nresulting in a denial of service. (CVE-2026-20213, CVE-2026-20214,\nCVE-2026-20217)\n\nIt was discovered that ClamAV incorrectly handled certain 7z archive\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\ncrash, resulting in a denial of service. (CVE-2026-20215)\n\nIt was discovered that ClamAV incorrectly handled extraction limits for\ncertain InstallShield archives. A remote attacker could possibly use this\nissue to cause ClamAV to use excessive resources, leading to a denial of\nservice. (CVE-2026-20216)\n\nIt was discovered that ClamAV incorrectly handled certain ALZ archive\nfiles. A remote attacker could possibly use this issue to cause ClamAV to\ncrash, resulting in a denial of service. (CVE-2026-20243)\n\nIt was discovered that ClamAV incorrectly handled certain DMG files. A\nremote attacker could possibly use this issue to cause ClamAV to crash,\nresulting in a denial of service. (CVE-2026-20244)","status":"published","published":"2026-07-08T14:07:06Z","modified":"2026-07-08T22:49:38.434628841Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}