SB2026080781 - Multiple vulnerabilities in ClamAV
Published: August 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Race condition (CVE-ID: N/A)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose process memory or cause a denial of service.
The vulnerability exists due to thread-safety issues in the clamd STATS command when scans and STATS requests run concurrently. A remote user can send concurrent STATS requests during scans to disclose process memory or cause a denial of service.
2) Race condition (CVE-ID: N/A)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to replace source paths during quarantine move and remove actions.
The vulnerability exists due to race condition in FreeBSD quarantine move and remove actions when handling source paths. A local user can manipulate source paths to replace them during quarantine move and remove actions.
This issue applies on FreeBSD.
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to resource leak in legacy hashing helpers when fetching a requested message digest. A local user can trigger a digest fetch failure to cause a denial of service.
The issue occurs when the default provider is unavailable in a FIPS-enabled environment.
4) Out-of-bounds write (CVE-ID: CVE-2026-20337)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond a heap allocation.
The vulnerability exists due to out-of-bounds write in ZIP catalogue capacity tracking when indexing local file headers. A remote attacker can provide a crafted ZIP archive to write beyond a heap allocation.
5) Out-of-bounds write (CVE-ID: CVE-2026-20345)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read or write beyond a stack-allocated partition entry.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in GPT partition name conversion when parsing partition names. A remote attacker can provide a crafted GPT structure to read or write beyond a stack-allocated partition entry.
6) Integer overflow (CVE-ID: CVE-2026-20339)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond an undersized buffer.
The vulnerability exists due to integer overflow in the PESpin unpacker when rebuilding a PE file. A remote attacker can provide a crafted PE file to write beyond an undersized buffer.
7) Double free (CVE-ID: CVE-2026-20338)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to invalid free in ZIP catalogue record merging when scanning a malformed archive. A remote attacker can provide a crafted archive to cause a denial of service.
8) Integer underflow (CVE-ID: CVE-2026-20346)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in the PDF parser when reading a malformed hex string. A remote attacker can provide a crafted PDF input to cause a denial of service.
9) Integer overflow (CVE-ID: CVE-2026-20347)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the Mach-O parser when scanning a malformed Mach-O file. A remote attacker can provide a crafted Mach-O file to cause a denial of service.
The advisory also mentions undefined behavior in the affected parser.
10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-20348)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper size handling in the XAR parser when decompressing a malformed table of contents. A remote attacker can provide a crafted XAR archive to cause a denial of service.
The issue can request an excessive allocation or exceed scan limits.
11) Path traversal (CVE-ID: CVE-2025-8088) Exploited
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences inside archives. A remote attacker can trick the victim into opening specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.