A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Zero-day Exploitation of this vulnerability has been observed. Immediate patching is recommended.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21831-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2719a8da-c3f8-11f1-8da1-3497f65b111b advisory.

    The ClamAV project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4208-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4179-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4180-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: ejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute
    arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was
    discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET. (CVE-2025-8088)

  - A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker
    to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an
    affected device. This vulnerability is due to improper boundary checks for content in PESpin files during
    scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by
    submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20339)

  - A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an
    affected device. This vulnerability is due to improper handling of an endian conversion operation, which
    may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a
    crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the
    attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected
    software. (CVE-2026-20345)

  - A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an
    affected device. This vulnerability is due to improper boundary checks for content in PDF files during
    scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability
    by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could
    allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the
    affected software. (CVE-2026-20346)

The remote host is running RARLAB WinRAR, an archive manager for Windows, whose reported version is prior to 7.13. It is, therefore, affected by a vulnerability:

  - A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary     code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton     Cherepanov, Peter Košinár, and Peter Strýček from ESET. (CVE-2025-8088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
367990	openSUSE 16: clamav / clamav-devel / clamav-milter / libclamav12 / etc (openSUSE-SU-2026:21831-1)	Nessus	SuSE Local Security Checks	Local	high
364507	FreeBSD : clamav -- Multiple vulnerabilities (2719a8da-c3f8-11f1-8da1-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
346804	SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4208-1)	Nessus	SuSE Local Security Checks	Local	high
346209	SUSE SLES12: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4179-1)	Nessus	SuSE Local Security Checks	Local	high
346206	SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4180-1)	Nessus	SuSE Local Security Checks	Local	high
445862	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
445862	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
248462	RARLAB WinRAR < 7.13 Directory Traversal (CVE-2025-8088)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2025-8088

high

Tenable Plugins

high

high

high

high

high

high

high

high