VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 3, 2015· Updated May 6, 2026

CVE-2015-1463

CVE-2015-1463

Description

ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ClamAV before 0.98.6 crashes when scanning a crafted petite packer file due to an incorrect compiler optimization, enabling remote denial of service.

Vulnerability

ClamAV versions prior to 0.98.6 contain a denial-of-service vulnerability in the petite packer file handler. A crafted petite packer file triggers an incorrect compiler optimization, causing a crash. The issue was discovered by Sebastian Andrzej Siewior and is fixed in ClamAV 0.98.6 [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted petite packer file to a system running an affected ClamAV version. No authentication or special privileges are required; the file only needs to be scanned by ClamAV, for example via email gateway or on-demand scanning.

Impact

Successful exploitation causes ClamAV to crash, resulting in a denial of service. No other impacts (such as code execution or information disclosure) have been reported.

Mitigation

Upgrade to ClamAV 0.98.6 or later, which includes a fix for this issue [1]. The Gentoo security advisory recommends upgrading to version 0.98.7 or higher [4]. No workarounds are available.

References
  1. ClamAV 0.98.6 has been released!
  2. Multiple vulnerabilities (GLSA 201512-08) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

8

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.