CVE-2026-20215: ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.
Other sources
ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/clamavto a version that resolves this vulnerability.Fixed in 1.4.5+dfsg-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20215?
CVE-2026-20215 has a high severity score of 7.5.
How does CVE-2026-20215 affect ClamAV?
CVE-2026-20215 affects ClamAV by enabling memory corruption through improper boundary checks in the 7z file format parser.
What potential impact does CVE-2026-20215 have?
The potential impact of CVE-2026-20215 includes denial-of-service (DoS) conditions and possible expanded impacts from memory corruption.
How can I fix CVE-2026-20215?
To fix CVE-2026-20215, ensure you update ClamAV to the latest version containing the security patch.
Who can exploit CVE-2026-20215?
CVE-2026-20215 can be exploited by unauthenticated, remote attackers.