A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

A flaw was found in ClamAV. An unauthenticated, remote attacker can exploit a vulnerability in the PESpin file format parser by submitting a specially crafted file. This flaw, caused by improper boundary checks, leads to an out-of-bounds buffer write and memory corruption. A successful exploit can cause the ClamAV scanning process to terminate, resulting in a Denial of Service (DoS) condition on the affected software.

This is an Important vulnerability in ClamAV's PESpin file format parser. An unauthenticated, remote attacker can exploit improper boundary checks by submitting a specially crafted PESpin file for scanning, leading to an out-of-bounds buffer write and memory corruption. This can cause the ClamAV scanning process to terminate, resulting in a Denial of Service condition. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. https://www.cve.org/CVERecord?id=CVE-2026-20217 https://nvd.nist.gov/vuln/detail/CVE-2026-20217 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR