ClamAV
ClamAV is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses. It was developed for Unix and has third party versions available for AIX, BSD, HP-UX, Linux, macOS, OpenVMS, OSF (Tru64), Solaris and Haiku. As of version 0.97.5, ClamAV builds and runs on Microsoft Windows. Both ClamAV and its updates are made available free of charge. One of its main uses is on mail servers as a server-side email virus scanner.
Products
9- 174 CVEs
- 13 CVEs
- 9 CVEs
- 2 CVEs
- 2 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
Recent CVEs
176| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-20032 | Cri | 0.66 | 9.8 | 0.29 | Mar 1, 2023 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to… | ||
| CVE-2017-12379 | Cri | 0.65 | 9.8 | 0.13 | Jan 26, 2018 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input… | ||
| CVE-2017-12377 | Cri | 0.65 | 9.8 | 0.12 | Jan 26, 2018 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input… | ||
| CVE-2025-20260 | Cri | 0.64 | 9.8 | 0.02 | Jun 18, 2025 | A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory… | ||
| CVE-2007-6745 | Cri | 0.64 | 9.8 | 0.02 | Nov 7, 2019 | clamav 0.91.2 suffers from a floating point exception when using ScanOLE2. | ||
| CVE-2007-0899 | Cri | 0.64 | 9.8 | 0.02 | Nov 6, 2019 | There is a possible heap overflow in libclamav/fsg.c before 0.100.0. | ||
| CVE-2013-7088 | Cri | 0.57 | 9.8 | 0.03 | Nov 15, 2019 | ClamAV before 0.97.7 has buffer overflow in the libclamav component | ||
| CVE-2013-7087 | Cri | 0.57 | 9.8 | 0.03 | Nov 15, 2019 | ClamAV before 0.97.7 has WWPack corrupt heap memory | ||
| CVE-2022-20803 | Hig | 0.56 | 8.6 | 0.01 | Feb 17, 2023 | A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that… | ||
| CVE-2022-20770 | Hig | 0.56 | 8.6 | 0.07 | May 4, 2022 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior… | ||
| CVE-2024-20290 | Hig | 0.51 | 7.5 | 0.34 | Feb 7, 2024 | A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may… | ||
| CVE-2022-20792 | Hig | 0.51 | 7.8 | 0.01 | Aug 10, 2022 | A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly… | ||
| CVE-2020-26893 | Hig | 0.51 | 7.8 | 0.00 | Oct 16, 2020 | An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client… | ||
| CVE-2019-1785 | Hig | 0.51 | 7.8 | 0.02 | Apr 8, 2019 | A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper… | ||
| CVE-2017-12376 | Hig | 0.51 | 7.8 | 0.07 | Jan 26, 2018 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input… | ||
| CVE-2026-20348 | Hig | 0.49 | 7.5 | 0.00 | Aug 7, 2026 | A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary… | ||
| CVE-2026-20347 | Hig | 0.49 | 7.5 | 0.00 | Aug 7, 2026 | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary… | ||
| CVE-2026-20346 | Hig | 0.49 | 7.5 | 0.00 | Aug 7, 2026 | A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary… | ||
| CVE-2026-20345 | Hig | 0.49 | 7.5 | 0.00 | Aug 7, 2026 | A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of… | ||
| CVE-2026-20337 | Hig | 0.49 | 7.5 | 0.00 | Aug 7, 2026 | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an… |
- risk 0.66cvss 9.8epss 0.29
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to…
- risk 0.65cvss 9.8epss 0.13
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input…
- risk 0.65cvss 9.8epss 0.12
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input…
- risk 0.64cvss 9.8epss 0.02
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory…
- risk 0.64cvss 9.8epss 0.02
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.
- risk 0.64cvss 9.8epss 0.02
There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
- risk 0.57cvss 9.8epss 0.03
ClamAV before 0.97.7 has buffer overflow in the libclamav component
- risk 0.57cvss 9.8epss 0.03
ClamAV before 0.97.7 has WWPack corrupt heap memory
- risk 0.56cvss 8.6epss 0.01
A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.The vulnerability is due to incorrect use of the realloc function that…
- risk 0.56cvss 8.6epss 0.07
On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior…
- risk 0.51cvss 7.5epss 0.34
A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may…
- risk 0.51cvss 7.8epss 0.01
A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an authenticated, local attacker to crash ClamAV at database load time, and possibly…
- risk 0.51cvss 7.8epss 0.00
An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client…
- risk 0.51cvss 7.8epss 0.02
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper…
- risk 0.51cvss 7.8epss 0.07
ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input…
- risk 0.49cvss 7.5epss 0.00
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary…
- risk 0.49cvss 7.5epss 0.00
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary…
- risk 0.49cvss 7.5epss 0.00
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary…
- risk 0.49cvss 7.5epss 0.00
A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of…
- risk 0.49cvss 7.5epss 0.00
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an…