Memory Corruption Vulnerability in ClamAV PE File Format Parser

CVE-2026-20213

What is CVE-2026-20213?

A vulnerability exists in the PE file format parser of ClamAV, which may allow an unauthenticated remote attacker to exploit the software. This exploitation is possible through improperly handled boundary checks for PE files during the scanning process. An attacker could submit a specially crafted file containing PE content that, when scanned, leads to an out-of-bounds buffer write. Consequently, this could terminate the ClamAV scanning process and potentially create a denial-of-service (DoS) condition. Prompt updates and configurations are recommended to mitigate this risk.

References