Description

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:02.413Z",
  "pubdate": "2026-08-07T17:17:02.413Z",
  "executiveSummary": "A denial of service vulnerability exists within the zip archive parser of ClamAV, potentially allowing unauthenticated, remote attackers to disrupt affected scanning services. The flaw stems from improper boundary checks during the inspection of zip file contents, leading directly to an out-of-bounds write condition. To exploit this vulnerability, a malicious actor must submit a specially crafted zip file to the target system for scanning. Upon processing the malicious input, the resulting out-of-bounds write triggers a fatal exception within the ClamAV scanning process, forcing it to terminate abnormally. This condition effectively causes a denial of service on the scanning engine, rendering it incapable of performing further malware analysis or threat detection until the service is manually restarted or recovered. The risk implication involves the complete bypass of email or file-based security inspection layers that rely on ClamAV for threat mitigation, leaving downstream systems temporarily exposed to secondary payloads. Exploitation requires network access to the scanning interface or submission vector, but does not necessitate prior authentication or elevated privileges on the target host.",
  "technicalDetails": "The vulnerability resides in the zip archive parsing component of ClamAV, specifically within the routines responsible for handling compressed file contents and metadata during scanning operations. The fundamental root cause is an insufficiency in boundary validation logic, where the parser fails to properly verify the size and offsets of data structures extracted from malicious zip archives against allocated memory buffers. When a crafted zip file containing manipulated headers or malformed compressed streams is submitted, the parsing engine calculates memory write operations based on untrusted size values provided within the archive structure. Because proper bounds checking is omitted, data is written past the boundaries of the intended destination buffer, culminating in an out-of-bounds write condition. The attack flow initiates when an unauthenticated remote attacker transmits the crafted zip file across the network to an endpoint configured to scan inbound traffic or storage volumes using ClamAV. No privileges are required to initiate this phase, provided the scanning service accepts untrusted file submissions. As the scanning engine ingests the file, the vulnerable zip archive parser processes the malicious structures, executes the out-of-bounds write, and corrupts adjacent memory regions. This memory corruption instantly destabilizes the runtime environment of the scanning process. The resulting payload behavior does not involve arbitrary code execution or privilege escalation; instead, the memory violation triggers an immediate segmentation fault or exception handler termination. Consequently, the ClamAV scanning daemon crashes, halting all active and queued inspection tasks. The post-exploitation impact is strictly limited to availability disruption, manifesting as a complete denial of service for the scanning capability of the affected software."
}