Description

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:03.003Z",
  "pubdate": "2026-08-07T17:17:03.003Z",
  "executiveSummary": "A memory corruption vulnerability exists within the GPT file format parser of ClamAV, potentially allowing an unauthenticated, remote attacker to trigger a Denial of Service (DoS) condition or achieve unspecified expanded impacts. The flaw stems from improper handling of an endian conversion operation during the parsing of GUID Partition Table (GPT) structures. When an affected device processes a maliciously crafted GPT file provided via scanning operations, the internal parsing logic experiences a critical flaw leading to an out-of-bounds buffer write. This compromises the integrity of the scanning process, resulting in abnormal termination of the ClamAV daemon or application. The risk implication centers on service availability disruption, as security infrastructure running vulnerable versions of ClamAV can be systematically crashed via remote file submission without requiring prior authentication or user interaction. Successful exploitation relies entirely on the targeted system ingesting and scanning the attacker-supplied adversarial file payload.",
  "technicalDetails": "The vulnerability resides specifically within the GPT file format parser component of ClamAV, which is responsible for inspecting and interpreting GUID Partition Table metadata within disk image or container files. The root cause of the vulnerability is improper handling of an endian conversion operation. During the deserialization or byte-swapping phase of multi-byte integers or structured fields within the GPT header or partition entries, the parser fails to properly validate boundary conditions or arithmetic outcomes associated with the translated data.\nThis flawed endian conversion logic directly precipitates an out-of-bounds buffer write condition. Specifically, when the parser calculates destination buffer offsets or allocation sizes based on unvalidated or improperly converted values derived from the crafted GPT file, data is written outside the allocated boundaries of the internal heap or stack buffers. Network exposure is present wherever ClamAV is deployed to automatically scan untrusted inbound files, mail attachments, or web uploads.\nThe attack flow proceeds in a deterministic step-by-step manner. First, an unauthenticated remote attacker crafts a specialized GPT file containing malicious values designed to trigger the endian conversion error and subsequent out-of-bounds write. Second, the attacker transmits this crafted file to the target system via standard input vectors processed by ClamAV, such as an email gateway, file transfer service, or network storage scanner. Third, the ClamAV scanning engine ingests the file and invokes the vulnerable GPT file format parser. Fourth, as the parser encounters the malicious fields, the improper endian conversion executes, resulting in memory corruption via an out-of-bounds buffer write. Finally, the memory corruption corrupts critical application state or triggers memory protection faults, causing the ClamAV scanning process to crash abruptly and instigating a Denial of Service condition on the host software. No privilege requirements are necessary for the attacker, and the exploitation vector is remotely accessible depending on the integration context of the scanning engine."
}