Clam AntiVirus 7z Archive Parsing Integer Overflow Remote Code Execution Vulnerability

August 13th, 2026
ZDI-26-583 ZDI-CAN-29416

CVE ID

CVE-2026-20215

CVSS Score

8.4 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Clam AntiVirus

Affected Products

Clam AntiVirus

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Clam AntiVirus. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of streams within 7z files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the ClamAV process.

Additional Details

Clam AntiVirus has issued an update to correct this vulnerability. More details can be found at:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR

Disclosure Timeline

  • 2026-05-20 - Vulnerability reported to vendor
  • 2026-08-13 - Coordinated public release of advisory
  • 2026-08-13 - Advisory Updated

Credit

Niv Moshe

Back to Advisories