ClamAV Double-free Vulnerability in the OLE2 File Parser

CVE-2022-20803

Summary

Clam AntiVirus versions 0.104.0 through 0.104.2 contain a vulnerability in the OLE2 file parser that may be exploited by unauthenticated remote attackers. By crafting a malicious OLE2 file and submitting it for scanning, an attacker can trigger a double-free condition due to improper handling of the realloc function, resulting in a crash of the scanning process. This could lead to a denial of service, disrupting the functionality of ClamAV on the affected device.

References