CVE-2026-20214
Description
A flaw was found in ClamAV. An unauthenticated, remote attacker could exploit a vulnerability in the FSG file format parser by submitting a specially crafted file for scanning. This improper handling of FSG files can lead to an out-of-bounds buffer write, causing memory corruption. A successful exploit results in a Denial of Service (DoS) condition, terminating the ClamAV scanning process.
Statement
This flaw in ClamAV is rated as Important because an unauthenticated, remote attacker can trigger a denial of service by submitting a specially crafted FSG file for scanning. This can lead to memory corruption and terminate the ClamAV scanning process, impacting services relying on ClamAV for content inspection.
Mitigation
To reduce the attack surface, restrict network access to the ClamAV daemon (clamd) to trusted clients only. This can be achieved by configuring firewall rules to limit connections to the port clamd listens on. For example, using `firewalld`:
`firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_ADDRESS>" port port="3310" protocol="tcp" accept'`
`firewall-cmd --reload`
Replace `<TRUSTED_IP_ADDRESS>` with the IP address or network range of trusted clients. This mitigation may impact legitimate scanning operations if not configured correctly. A restart of the `clamd` service may be required for changes to take full effect.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
