Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-01T16:27:51 ClamAV: ClamAV: Denial of Service via crafted InstallShield file 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

A flaw was found in ClamAV's InstallShield file format parser. An unauthenticated, remote attacker could exploit this vulnerability by submitting a specially crafted InstallShield file for scanning. This improper handling of temporary resources during file scanning could lead to the termination of the ClamAV scanning process and temporary consumption of system resources, resulting in a Denial of Service (DoS) condition on the affected device.

ClamAV, when deployed in Red Hat environments, is often used for scanning untrusted files. This Important flaw allows an unauthenticated, remote attacker to cause a denial of service by submitting a specially crafted InstallShield file. Successful exploitation can lead to the ClamAV scanning process terminating and consuming system resources, impacting the availability of the scanning service. To reduce the risk of denial of service, deploy ClamAV within a sandboxed environment to contain potential resource exhaustion. Additionally, exercise caution when processing untrusted InstallShield files, and restrict their sources to trusted origins where possible. https://www.cve.org/CVERecord?id=CVE-2026-20216 https://nvd.nist.gov/vuln/detail/CVE-2026-20216 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR