CVE-2016-1371

What it actually does

The flaw permits a locally processed crafted mew packer executable to trigger a crash in the ClamAV scanning engine, resulting in denial of service with high availability impact and no confidentiality or integrity loss.

Why it matters to the business

Disruption of malware scanning operations can interrupt security tooling workflows and delay detection activities, though low exploitability and absence from active campaigns limit immediate operational risk.

How an attack unfolds

An attacker prepares a malicious executable using the mew packer format and causes it to be scanned by a vulnerable ClamAV instance, leading to an application crash; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade affected Chainguard cert-manager-fips-1.13 installations to version 1.13.5-r1 or later; verify the updated package resolves the embedded ClamAV component to at least 0.99.2.

How to confirm the fix worked

Confirm the running ClamAV or product version meets or exceeds the fixed release; test by attempting to scan a known mew-packed sample in a controlled environment and verify no crash occurs.

Typical attack path

1. Craft a malicious executable using the mew packer format
2. Place the file in a location that will be scanned by ClamAV
3. Trigger a scan through local file access or automated tooling
4. Induce application crash via the parsing flaw

How to detect it

Inspect application and system logs for ClamAV crashes or errors during executable parsing; correlate with file access events involving mew-packed binaries.

What your security team should do

• Apply the specified upgrade to 1.13.5-r1 immediately for all cert-manager-fips-1.13 deployments
• Review scanning pipelines for exposure to untrusted executables
• Monitor EPSS and KEV status for any future changes in exploit availability