Description

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:02.610Z",
  "pubdate": "2026-08-07T17:17:02.610Z",
  "executiveSummary": "A denial of service (DoS) vulnerability exists within the zip archive parser of ClamAV, stemming from improper memory handling during the scanning of specially crafted zip files. This flaw enables an unauthenticated, remote attacker to trigger a memory double-free condition, resulting in the abnormal termination of the ClamAV scanning process. The vulnerability affects systems running the vulnerable ClamAV software where automated or manual file scanning operations are performed on untrusted archives. Successful exploitation requires the submission or processing of a maliciously crafted zip file by the scanning engine. The primary risk implication is service disruption and loss of availability, as the scanning daemon or process crashes upon encountering the payload, potentially leaving the host system unprotected against subsequent malware threats until the service is manually or automatically restarted. No remote code execution or privilege escalation capabilities are indicated as part of this vulnerability mechanism.",
  "technicalDetails": "The vulnerability resides in the zip archive parser component of ClamAV, specifically within the routines responsible for memory allocation and deallocation during the parsing and inspection of compressed content within zip containers. The root cause is categorized as improper memory management, specifically manifesting as a memory double-free vulnerability. A double-free condition occurs when the application attempts to release the same memory region multiple times, corrupting the internal heap metadata managed by the memory allocator. When ClamAV processes a maliciously crafted zip file, the parsing logic improperly handles specific file structures or metadata fields, leading to redundant free operations on identical heap pointers. This memory corruption triggers a fatal runtime error, causing the operating system or runtime environment to abort the process immediately to prevent further memory corruption or undefined behavior. The attack flow begins when an unauthenticated, remote attacker submits a crafted zip file to an endpoint, service, or mail gateway utilizing ClamAV for threat inspection. No prior authentication or privileged access is required to interact with the scanning interface, provided the system accepts untrusted file submissions. Upon ingestion, the ClamAV scanning engine invokes the vulnerable zip parser to inspect the contents of the archive. As the parser navigates the malicious structures within the zip file, the flawed memory management logic is executed. The malformed data induces the application to execute a double-free on a targeted memory chunk. Consequently, the ClamAV scanning process terminates abruptly, inducing a denial of service condition across the affected scanning pipeline. Post-exploitation impact is strictly confined to process termination and loss of availability; the vulnerability does not facilitate arbitrary code execution, unauthorized data access, or privilege escalation."
}