Description

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:02.807Z",
  "pubdate": "2026-08-07T17:17:02.807Z",
  "executiveSummary": "An integer overflow vulnerability exists in the ClamAV anti-malware software, specifically within the PESpin file format parser. This security flaw stems from insufficient boundary checks performed on content contained within PESpin files during the scanning process.\nAn unauthenticated, remote attacker can exploit this vulnerability by submitting a maliciously crafted file containing specifically manipulated PESpin content to a targeted device running an affected version of ClamAV.\nSuccessful exploitation of this vulnerability leads to memory corruption, which subsequently forces the ClamAV scanning process to abruptly terminate. This results in a denial of service (DoS) condition on the affected software, disrupting security operations and potentially leaving the host system unprotected against further threats.\nThe attack requires no prior authentication or user privileges, relying solely on the ability to deliver a crafted file to the scanning engine via standard operational workflows.",
  "technicalDetails": "The root cause of the vulnerability resides in the PESpin file format parser component of ClamAV. During the routine scanning and parsing of files utilizing the PESpin packer structure, the software fails to perform adequate boundary checks on numerical values and content sizing extracted from the file headers or data sections.\nWhen ClamAV processes a maliciously crafted PESpin file, the unchecked values can trigger an integer overflow condition during internal arithmetic calculations related to memory allocation or buffer sizing. This integer wrapping typically leads to the allocation of a buffer size that is significantly smaller than required for the incoming data.\nSubsequent copy or write operations attempting to populate this undersized buffer result in out-of-bounds memory writes and heap or stack memory corruption.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious file featuring a specially crafted PESpin header or payload designed to induce an integer overflow during calculation phases in the parser. Second, the attacker transmits or exposes this file to a system running ClamAV, such that the scanning engine ingests and analyzes it. Third, as the PESpin parser evaluates the file, the arithmetic operation overflows due to the absence of proper validation checks. Fourth, the resulting incorrect size calculation leads to memory corruption when data is processed into memory buffers. Finally, the operating system detects the anomalous memory state or invalid instruction execution, forcing the ClamAV scanning process to crash and terminate abnormally, thereby inducing a denial of service.\nThe vulnerability affects the ClamAV scanning engine where the PESpin parser is implemented. Exploitation is remote in the context of network-based file scanning vectors (e.g., mail servers, content gateways, or file sharing services utilizing ClamAV for inspection), requires no authentication, and demands no privileged access, as the trigger mechanism relies entirely on parsing untrusted file data."
}