CVE-2026-20215
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jul 1, 2026
CISA due date
—
The record
A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | clamav | 0 | 1.5.3-1.1 |
Related vulnerabilities
- CVE-2026-20217 A vulnerability in the PESpin file format parser of ClamAV could allow an… Also affects clamav
- CVE-2026-20244 A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-20243 A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-20216 A vulnerability in the InstallShield file format parser of ClamAV could allow an… Also affects clamav
- CVE-2026-20213 A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-20214 A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated… Also affects clamav
- CVE-2026-41676 rust-openssl provides OpenSSL bindings for the Rust programming language. Also affects clamav
- CVE-2026-20031 A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an… Also affects clamav