CVE-2014-9328

What it actually does

Heap out-of-bounds condition in ClamAV before 0.98.6 triggered by a crafted upack packer file, resulting in memory corruption with unspecified impact.

Why it matters to the business

Attackers may crash antivirus scanning or gain remote code execution on systems relying on the vulnerable engine, reducing malware detection effectiveness and potentially allowing further compromise; no known ransomware use or CISA deadline applies.

How an attack unfolds

An attacker crafts a malicious upack-packed file and delivers it to a target environment where ClamAV performs scanning, triggering the heap corruption during unpacking.

How to fix it

Upgrade ClamAV to version 0.98.6 or later; for affected Debian and Ubuntu packages listed, apply the specified fixed versions such as squid 4.1-1 on Debian 11/12/13 and squid3 3.3.8-1ubuntu6.8 on Ubuntu 14.04 LTS or 3.5.12-1ubuntu7.2 on Ubuntu 16.04 LTS.

How to confirm the fix worked

Verify ClamAV version is at least 0.98.6; confirm package versions match the fixed releases on Debian/Ubuntu systems and test scanning of sample upack files.

Typical attack path

1. Craft malicious upack packer file
2. Deliver file via email, web, or network share
3. Trigger ClamAV scan on the file
4. Exploit resulting heap out-of-bounds condition

How to detect it

Review ClamAV logs and process crashes for signs of upack file handling failures; check system logs for unexpected memory corruption events related to the scanner.

What your security team should do

• Prioritize upgrade of ClamAV and listed squid packages to fixed versions
• Scan for presence of vulnerable ClamAV instances across the environment
• Monitor EPSS trend (stable at ~0.032) and absence from KEV for risk prioritization