VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 1, 2014· Updated May 6, 2026

CVE-2014-9050

CVE-2014-9050

Description

Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Heap-based buffer overflow in ClamAV before 0.98.5 allows remote attackers to cause a denial of service via a crafted y0da Crypter PE file.

Vulnerability

A heap-based buffer overflow exists in the cli_scanpe function in libclamav/pe.c of ClamAV before version 0.98.5. The vulnerability is triggered when scanning a specially crafted PE file obfuscated with the y0da Crypter packer. The overflow occurs during section header processing where the code fails to properly validate section offsets and sizes, leading to writes beyond allocated heap memory [1][3].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious PE file with manipulated section headers that cause the cli_scanpe function to write beyond the bounds of a heap buffer. The attacker does not require any special privileges or user interaction; simply sending the file to a ClamAV scan (e.g., via email attachment or file upload) is sufficient. No authentication is needed, and the attack vector is remote over the network [2][4].

Impact

Successful exploitation results in a denial of service (crash) of the ClamAV process. While the available references primarily describe a crash, the overflow potentially could be leveraged for arbitrary code execution under certain conditions, as noted in the Ubuntu security advisory [2]. The crash disrupts antivirus scanning capabilities, potentially leaving systems vulnerable to other malware.

Mitigation

The vulnerability is fixed in ClamAV version 0.98.5, which was released on November 25, 2014 [4]. Users should upgrade to this version or later. The official ClamAV blog and Ubuntu security notice confirm the availability of the patched release [2][4]. No workarounds are documented; updating the software is the recommended action.

References
  1. Merge fix from security/bb11155 branch · Cisco-Talos/clamav@fc3794a
  2. USN-2423-1: ClamAV vulnerabilities | Ubuntu security notices | Ubuntu
  3. security - Re: CVE request: heap buffer overflow in ClamAV
  4. ClamAV 0.98.5 has been released!

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

101
  • ClamAV/Clamav100 versions
    cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*+ 99 more
    • cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*range: <=0.94.3
    • cpe:2.3:a:clamav:clamav:0.01:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.02:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.03:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.05:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.14:pre:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.21:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.22:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.23:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.24:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.51:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.52:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.53:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.54:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.60:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.60p:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.65:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.66:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.67:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.67-1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.68:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.68.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.70:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.70:rc:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.71:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.72:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.73:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.74:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.75:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.75.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:rc:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80_rc:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:rc2:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:rc3:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.80:rc4:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.81:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.81:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.82:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.83:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.84:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.84:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.84:rc2:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.85:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.85.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.86:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.86.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.86.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.86:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.87:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.87.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.3:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.4:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.5:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.6:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.7:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.7_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.88.7_p1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.8:rc3:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.1_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.2_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.3:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.3_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90.3_p1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90:rc1.1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90:rc2:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.90:rc3:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91.2_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91:rc1:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.91:rc2:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.92:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.92.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.92_p0:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.93:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.93.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.93.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.93.3:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.94:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.94.1:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.94.2:*:*:*:*:*:*:*
    • cpe:2.3:a:clamav:clamav:0.9:rc1:*:*:*:*:*:*
    • (no CPE)range: <0.98.5
  • osv-coords
    pkg:rpm/opensuse/clamav&distro=openSUSE%20Tumbleweed
    Range: < 1.4.2-1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.