CVE-2026-20348: ClamAV XAR File Format Processing Memory Corruption Vulnerability
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Other sources
ClamAV XAR File Format Processing Memory Corruption Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20348?
CVE-2026-20348 has a severity rating of 7.5, classified as high.
How do I fix CVE-2026-20348?
To fix CVE-2026-20348, update ClamAV to the latest version where this vulnerability is patched.
What impact does CVE-2026-20348 have on systems?
CVE-2026-20348 can lead to a denial of service (DoS) condition or potentially other expanded impacts due to memory corruption.
Who is affected by CVE-2026-20348?
All users running affected versions of ClamAV that utilize the XAR file format parser are at risk due to CVE-2026-20348.
Can CVE-2026-20348 be exploited remotely?
Yes, CVE-2026-20348 can be exploited by an unauthenticated remote attacker.