CVE-2026-20337: ClamAV ZIP File Format Processing Memory Corruption Vulnerability
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20337?
The severity of CVE-2026-20337 is rated high with a score of 7.5.
How do I fix CVE-2026-20337?
To fix CVE-2026-20337, update ClamAV to the latest version that addresses this zip file processing vulnerability.
What type of vulnerability is CVE-2026-20337?
CVE-2026-20337 is a memory corruption vulnerability specifically related to the zip archive parser in ClamAV.
Can CVE-2026-20337 be exploited remotely?
Yes, CVE-2026-20337 can be exploited remotely by an unauthenticated attacker.
What does CVE-2026-20337 allow an attacker to do?
CVE-2026-20337 allows an attacker to cause a denial of service (DoS) condition on an affected device.