Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-20214: ClamAV may crash when scanning crafted FSG files
CVE-2026-20214 · published 4 months ago
Summary
ClamAV on Debian can be forced to stop working if it scans a specially made FSG‑compressed file. The flaw comes from not checking the file size correctly, which can corrupt memory and shut down the scanner. Update ClamAV to the latest version or apply the vendor’s patch to prevent the crash.
What to do
- Update debian clamav to version 1.4.5+dfsg-1.
- Update debian clamav to version 1.4.6+dfsg-0+deb12u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | clamav | All versions |
| Debian:12 | debian | clamav |
< 1.4.6+dfsg-0+deb12u1 Fix: upgrade to 1.4.6+dfsg-0+deb12u1
|
| Debian:13 | debian | clamav | All versions |
| Debian:14 | debian | clamav |
< 1.4.5+dfsg-1 Fix: upgrade to 1.4.5+dfsg-1
|
Original advisory text
A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruptio...
A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.
This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-120Classic Buffer Overflow
Timeline
Published1 Jul 2026
Updated4 Nov 2026
First seen1 Jul 2026
Track software like this
Free during beta