High severity7.5NVD Advisory· Published Aug 7, 2026· Updated Aug 11, 2026
CVE-2026-20338
CVE-2026-20338
Description
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.
This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords4 versionspkg:rpm/opensuse/clamav&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/clamav&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/clamav-1.5pkg:apk/wolfi/clamav-1.5
< 1.5.4-160000.1.1+ 3 more
- (no CPE)range: < 1.5.4-160000.1.1
- (no CPE)range: < 1.5.4-1.1
- (no CPE)range: < 1.5.4-r0
- (no CPE)range: < 1.5.4-r0
Patches
Vulnerability mechanics
References
1News mentions
4- ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and MoreThe Hacker News · Aug 17, 2026
- Breach Roundup: Def Con Dolt Suspected in Delta Wi-Fi HackGovInfoSecurity · Aug 14, 2026
- Multiple ClamAV Vulnerabilities Allow Remote Attacker to Trigger DoS ConditionCyber Security News · Aug 11, 2026
- Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoCSecurityWeek · Aug 10, 2026