CVE-2026-20031
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Mar 4, 2026
CISA due date
—
The record
A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | clamav-1.4 | 0 | 0 |
| Chainguard | clamav-1.5 | 0 | 0 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | clamav | 0 | 1.5.2-150600.18.25.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | clamav | 0 | 1.5.2-150600.18.25.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | clamav | 0 | 1.5.2-150600.18.25.1 |
| Wolfi | clamav-1.4 | 0 | 0 |
| Wolfi | clamav-1.5 | 0 | 0 |
| openSUSE:Leap 15.6 | clamav | 0 | 1.5.2-150600.18.25.1 |
| openSUSE:Leap 16.0 | clamav | 0 | 1.5.2-160000.1.1 |
| openSUSE:Tumbleweed | clamav | 0 | 1.5.2-1.1 |
Related vulnerabilities
- CVE-2025-20128 A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV… Also affects clamav-1.4
- CVE-2024-20506 A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0… Also affects clamav-1.4
- CVE-2024-20505 A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0… Also affects clamav-1.4
- CVE-2023-20197 A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+)… Also affects clamav
- CVE-2026-20217 A vulnerability in the PESpin file format parser of ClamAV could allow an… Also affects clamav
- CVE-2026-20244 A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-20243 A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-20216 A vulnerability in the InstallShield file format parser of ClamAV could allow an… Also affects clamav