CVE-2026-20215
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or other impacts due to memory corruption. It is caused by improper boundary checks in 7z files during scanning, leading to an out-of-bounds buffer write.
Risk Assessment
An attacker could exploit this by submitting a crafted 7z file for scanning, causing the ClamAV scanning process to terminate and resulting in a DoS condition, potentially disrupting antivirus operations.
Recommendation
Immediately update ClamAV to the latest version containing the fix for CVE-2026-20215 and monitor vendor advisories for patch details.
Other vulnerabilities in ClamAV
See all- CVE-2015-1462High
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a 'heap out of bounds condition.'
- CVE-2015-1461High
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted Yoda's crypter or mew packer file, related to a 'heap out of bounds condition.'
- CVE-2014-9328High
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a 'heap out of bounds condition.'
- CVE-2026-20348High
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks for content in XAR files during scanning.
- CVE-2026-20347High
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.
- CVE-2026-20346High
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.
- CVE-2026-20345High
A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write.
- CVE-2026-20339High
A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other impacts due to memory corruption. The issue is caused by improper boundary checks in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this by submitting a crafted file with PESpin content to be scanned by ClamAV.
- CVE-2026-20338High
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to improper memory handling when processing zip files during scanning. An attacker could exploit this by submitting a crafted zip file for scanning.
- CVE-2026-20337High
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to improper boundary checks for zip file content during scanning, which may result in an out-of-bounds write. An attacker could exploit this by submitting a crafted zip file for scanning.
Original NVD description (English source)
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.