Description

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:03.140Z",
  "pubdate": "2026-08-07T17:17:03.140Z",
  "executiveSummary": "An out-of-bounds buffer read vulnerability exists within the PDF file format parser of ClamAV, an open-source antivirus scanning toolkit. The flaw arises from insufficient boundary validation checks when processing the contents of malicious or malformed PDF files.\nA remote, unauthenticated attacker can exploit this security weakness by submitting a maliciously crafted PDF file to be evaluated by an affected ClamAV instance. Successful exploitation leads to memory corruption, forcing the ClamAV scanning daemon or process to crash abruptly.\nThis behavior directly results in a Denial of Service (DoS) condition on the host system running the vulnerable software, and potentially introduces expanded security impacts depending on the host's execution context and memory layout.\nThe risk implication is particularly significant for email gateways, web proxies, and file servers that utilize ClamAV for automated, real-time malware analysis, as an adversary can persistently trigger service outages against the scanning infrastructure.\nNo elevated privileges or user interaction beyond submitting the payload to the scanning engine are required for successful exploitation.",
  "technicalDetails": "The root cause of the vulnerability resides in the PDF file format parsing component of ClamAV. During the parsing lifecycle, the scanning engine extracts and processes various streams and objects defined within the PDF structure.\nSpecifically, the parser fails to properly enforce rigorous boundary checks on internal content lengths and offsets before executing memory read operations. This lack of bounds validation allows the parsing routines to read past the allocated boundaries of internal heap or stack buffers.\nThe affected component is the internal PDF parser module utilized during routine signature scanning and content analysis. Network exposure depends on how ClamAV is integrated into upstream applications, but remote exploitation is feasible if the scanning engine processes untrusted files sourced externally via mail transfer agents, web uploads, or network file shares.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious PDF file containing manipulated structural metadata or object streams designed to deceive the parser regarding data length. Second, the attacker transmits this crafted file to a target system utilizing ClamAV for inspection. Third, the ClamAV daemon ingests the file and invokes the vulnerable PDF parser. Fourth, as the parser processes the malicious structures, it attempts an out-of-bounds buffer read. Finally, the unauthorized memory access triggers a segmentation fault or memory corruption exception, causing the scanning process to crash and resulting in a Denial of Service.\nPrerequisites for this attack include unauthenticated network access to submit files to the scanning pipeline. The payload behavior is strictly destructive to the scanning process stability, terminating execution immediately upon parsing the malicious structures."
}