Description

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted Mach-O file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T17:17:03.337Z",
  "pubdate": "2026-08-07T17:17:03.337Z",
  "executiveSummary": "A memory corruption vulnerability exists within the Mach-O file format parser of ClamAV, specifically arising from improper boundary checks during the scanning of crafted files. This flaw is classified as an out-of-bounds buffer read. An unauthenticated, remote attacker can exploit this vulnerability by submitting a maliciously crafted Mach-O file to be scanned by an affected ClamAV instance. Successful exploitation results in the termination of the ClamAV scanning process, leading to a denial of service (DoS) condition on the targeted device, with potential for broader memory corruption impacts.",
  "technicalDetails": "The vulnerability resides in the Mach-O file format parser component of ClamAV, which fails to perform adequate boundary checks when parsing file contents during standard scanning operations. The root cause is the absence of rigorous input validation and size verification prior to memory access operations, enabling an out-of-bounds buffer read condition. Exploitation requires an unauthenticated, remote attacker to deliver a specially crafted Mach-O file to the scanning engine via standard submission vectors. The attack flow initiates when ClamAV ingests and attempts to parse the malicious file structure. As the parser reads the malformed headers or internal data structures, it attempts to access memory offsets that exceed the allocated bounds of the buffer. This invalid memory access triggers a segmentation fault or similar exception, forcing the ClamAV scanning process to crash abruptly. Because no authentication or elevated privileges are required to submit files for scanning in typical integration scenarios, an attacker can remotely trigger the denial of service condition repeatedly, degrading the availability of security services relying on ClamAV."
}