A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2833-1 advisory.

    This update for clamav fixes the following issues

    - CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270107).
    - CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270085).
    - CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270088).
    - CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to     cause a denial of       service (bsc#1270089).
    - CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a     denial of service       (bsc#1270091).
    - CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270092).
    - CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       on 32-bit platforms only (bsc#1270106).
    - CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on     OpenSSL 1.1.1       (bsc#1270138).

    Changes for clamav:

    - Update to 1.5.3:

      * Hardened clamscan, clamdscan, and clamonacc quarantine actions against         time-of-check/time-of-use races that could redirect copied, moved, or removed         files under unsafe quarantine directory configurations.
      * Raised the minimum required CMake version to 3.17 to fix Linux builds with         libcurl v8.21.0 when linking static library dependencies.
      * Metadata preclass scans now run before the final scan verdict.
      * ClamOnAcc: Fixed errors when recursively excluded paths are children of an         included path.
      * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide      in the same bucket.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2835-1 advisory.

    This update for clamav fixes the following issues

    - CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270107).
    - CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270085).
    - CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270088).
    - CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to     cause a denial of       service (bsc#1270089).
    - CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a     denial of service       (bsc#1270091).
    - CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270092).
    - CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       on 32-bit platforms only (bsc#1270106).
    - CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on     OpenSSL 1.1.1       (bsc#1270138).

    Changes for clamav:

    - update to 1.5.3:

     * Hardened clamscan, clamdscan, and clamonacc quarantine actions against      time-of-check/time-of-use races that could redirect copied, moved, or removed      files under unsafe quarantine directory configurations.
     * Raised the minimum required CMake version to 3.17 to fix Linux builds with      libcurl v8.21.0 when linking static library dependencies.
     * Metadata preclass scans now run before the final scan verdict.
     * ClamOnAcc: Fixed errors when recursively excluded paths are children of an      included path.
     * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide      in the same bucket.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2834-1 advisory.

    This update for clamav fixes the following issues

    - CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270107).
    - CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270085).
    - CVE-2026-20215: 7z file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270088).
    - CVE-2026-20216: InstallShield file format parser could allow an unauthenticated, remote attacker to     cause a denial of       service (bsc#1270089).
    - CVE-2026-20217: PESpin file format parser could allow an unauthenticated, remote attacker to cause a     denial of service       (bsc#1270091).
    - CVE-2026-20243: ALZ file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       (bsc#1270092).
    - CVE-2026-20244: DMG file format parser could allow an unauthenticated, remote attacker to cause a denial     of service       on 32-bit platforms only (bsc#1270106).
    - CVE-2026-41676: rust-openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on     OpenSSL 1.1.1       (bsc#1270138).

    Changes for clamav:

    - Update to 1.5.3:

      * Hardened clamscan, clamdscan, and clamonacc quarantine actions against         time-of-check/time-of-use races that could redirect copied, moved, or removed         files under unsafe quarantine directory configurations.
      * Raised the minimum required CMake version to 3.17 to fix Linux builds with         libcurl v8.21.0 when linking static library dependencies.
      * Metadata preclass scans now run before the final scan verdict.
      * ClamOnAcc: Fixed errors when recursively excluded paths are children of an         included path.
      * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide         in the same bucket.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21252-1 advisory.

    Update to version 1.5.3.

    Security issues fixed:

    - CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during     scanning       (bsc#1270107).
    - CVE-2026-20214: out-of-bounds write due to improper boundary checks for content in FSG files during     scanning       (bsc#1270085).
    - CVE-2026-20215: out-of-bounds write due to improper boundary checks for content in 7z files during     scanning       (bsc#1270088).
    - CVE-2026-20216: denial of service due to improper handling of temporary resources during InstallShield     file scanning       (bsc#1270089).
    - CVE-2026-20217: out-of-bounds write due to improper boundary checks for content in PESpin files during     scanning       (bsc#1270091).
    - CVE-2026-20243: out-of-bounds write due to improper boundary checks for content in ALZ files during     scanning       (bsc#1270092).
    - CVE-2026-20244: integer overflow and DoS due to improper boundary checks for content in DMG files during     scanning       (bsc#1270106).
    - CVE-2026-41676: buffer overflow due to missing checks via `Deriver:derive`, `PkeyCtxRef:derive` and     OpenSSL 1.1.1       (bsc#1270138).

    Other updates and bugfixes:

    - Version 1.5.3:
     * Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer     and crash the        scanner.
     * Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed     Aspack-packed PE        file and lead to a heap buffer overflow write.
     * Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than     intended and        exhaust temporary storage.
     * Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed     PE file.
     * Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the     scanner, or skip        expected scan-limit handling.
     * Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write     past them        while reading a malformed archive.
     * Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash     32-bit        scanner builds.
     * Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races     that could        redirect copied, moved, or removed files under unsafe quarantine directory configurations.
     * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and     upgraded the        Rust openssl dependency to resolve CVE-2026-41676.
     * Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking     static        library dependencies.
     * Metadata preclass scans now run before the final scan verdict.
     * ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.
     * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8517-1 advisory.

    It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20213, CVE-2026-20214,     CVE-2026-20217)

    It was discovered that ClamAV incorrectly handled certain 7z archive files. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20215)

    It was discovered that ClamAV incorrectly handled extraction limits for certain InstallShield archives. A     remote attacker could possibly use this issue to cause ClamAV to use excessive resources, leading to a     denial of service. (CVE-2026-20216)

    It was discovered that ClamAV incorrectly handled certain ALZ archive files. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20243)

    It was discovered that ClamAV incorrectly handled certain DMG files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20244)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in DMG files during scanning,
    which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this
    vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an
    affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to
    terminate, resulting in a DoS condition on the affected software. (CVE-2026-20244)

  - A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in PE files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20213)

  - A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in FSG files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains portable executable content compressed with FSG to be scanned by
    ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning
    process to terminate, resulting in a DoS condition on the affected software. (CVE-2026-20214)

  - A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to
    cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected
    device. This vulnerability is due to improper boundary checks for content in 7z files during scanning,
    which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by
    submitting a crafted file that contains 7z&nbsp;content to be scanned by ClamAV on an affected device. A
    successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting
    in a DoS condition on the affected software. (CVE-2026-20215)

  - A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote
    attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of
    temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a
    crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow
    the attacker to terminate the ClamAV scanning process and temporarily consume available system resources,
    resulting in a DoS condition on the affected software. (CVE-2026-20216)

According to its self-reported version, Cisco Secure Endpoint is affected by multiple vulnerabilities.

  - A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in PE files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting     in a DoS condition on the affected software. (CVE-2026-20213)

  - A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in FSG files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains portable executable content compressed with FSG to be scanned by     ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning     process to terminate, resulting in a DoS condition on the affected software. (CVE-2026-20214)

  - A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in 7z files during scanning,     which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by     submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting     in a DoS condition on the affected software. (CVE-2026-20215)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected     device. This vulnerability is due to improper boundary checks for content in DMG files during scanning,     which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this     vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an     affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     terminate, resulting in a DoS condition on the affected software. (CVE-2026-20244)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326326	SUSE SLES12: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:2833-1)	Nessus	SuSE Local Security Checks	critical
326324	SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:2835-1)	Nessus	SuSE Local Security Checks	critical
326317	SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:2834-1)	Nessus	SuSE Local Security Checks	critical
326031	openSUSE 16: clamav / clamav-devel / clamav-milter / libclamav12 / etc (openSUSE-SU-2026:21252-1)	Nessus	SuSE Local Security Checks	critical
325962	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8517-1)	Nessus	Ubuntu Local Security Checks	high
444468	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
444468	Alpine: multiple clamav packages, multiple freshclam packages: security update to 1.4.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
324975	Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-88cFYyxR)	Nessus	CISCO	high
324764	Linux Distros Unpatched Vulnerability : CVE-2026-20244	Nessus	Misc.	high

Detections

Analytics

CVE-2026-20244

high

Tenable Plugins

critical

critical

critical

critical

high

high

high

high

high