
CVE catalog
CVE-2026-20337
A vulnerability in the zip archive parser of ClamAV…
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.60% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-base",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-daemon",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-doc",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-docs",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-freshclam",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-milter",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav-testfiles",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamdscan",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "libclamav-dev",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "libclamav12",
"distro": "ubuntu",
"ranges": [
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1",
"introduced": "0"
}
],
"release": "noble",
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-160000.1.1"
}
]
}
],
"release": "linux enterprise server 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-160000.1.1",
"provider_record_id": "SUSE-SU-2026:23706-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-160000.1.1"
}
]
}
],
"release": "linux enterprise server for sap applications 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-160000.1.1",
"provider_record_id": "SUSE-SU-2026:23706-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-160000.1.1"
}
]
}
],
"release": "linux enterprise server 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-160000.1.1",
"provider_record_id": "SUSE-SU-2026:23727-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-160000.1.1"
}
]
}
],
"release": "linux enterprise server for sap applications 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-160000.1.1",
"provider_record_id": "SUSE-SU-2026:23727-1"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.22.04.1"
}
]
}
],
"release": "22.04",
"versions": [
"0.103.3+dfsg-1",
"0.103.4+dfsg-1",
"0.103.4+dfsg-1build1",
"0.103.5+dfsg-1",
"0.103.6+dfsg-0ubuntu0.22.04.1",
"0.103.8+dfsg-0ubuntu0.22.04.1",
"0.103.9+dfsg-0ubuntu0.22.04.1",
"0.103.11+dfsg-0ubuntu0.22.04.1",
"0.103.12+dfsg-0ubuntu0.22.04.1",
"1.4.3+dfsg-0ubuntu0.22.04.1",
"1.4.4+dfsg-0ubuntu0.22.04.1",
"1.5.3+dfsg-0ubuntu0.22.04.2"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.22.04.1",
"provider_record_id": "USN-8788-1"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1"
}
]
}
],
"release": "24.04",
"versions": [
"1.0.2+dfsg-1ubuntu1",
"1.0.3+dfsg-2ubuntu1",
"1.0.4+dfsg-0ubuntu1",
"1.0.5+dfsg-1ubuntu1",
"1.0.5+dfsg-1.1ubuntu2",
"1.0.5+dfsg-1.1ubuntu3",
"1.0.7+dfsg-0ubuntu0.24.04.1",
"1.0.8+dfsg-0ubuntu0.24.04.1",
"1.4.3+dfsg-0ubuntu0.24.04.1",
"1.4.4+dfsg-0ubuntu0.24.04.1",
"1.5.3+dfsg-0ubuntu0.24.04.1"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1",
"provider_record_id": "USN-8788-1"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.26.04.1"
}
]
}
],
"release": "26.04",
"versions": [
"1.4.3+dfsg-0ubuntu2",
"1.4.3+dfsg-0ubuntu3",
"1.4.3+dfsg-2ubuntu1",
"1.4.3+dfsg-2ubuntu2",
"1.4.3+dfsg-2ubuntu3",
"1.4.4+dfsg-0ubuntu0.26.04.1",
"1.5.3+dfsg-0ubuntu0.26.04.1",
"1.5.3+dfsg-0ubuntu0.26.04.2"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.26.04.1",
"provider_record_id": "USN-8788-1"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"0.101.4+dfsg-1ubuntu1",
"0.102.1+dfsg-1ubuntu1",
"0.102.1+dfsg-2ubuntu1",
"0.102.1+dfsg-2ubuntu2",
"0.102.2+dfsg-1ubuntu1",
"0.102.2+dfsg-2ubuntu1",
"0.102.3+dfsg-0ubuntu0.20.04.1",
"0.102.4+dfsg-0ubuntu0.20.04.1",
"0.103.2+dfsg-0ubuntu0.20.04.1",
"0.103.2+dfsg-0ubuntu0.20.04.2",
"0.103.5+dfsg-1~20.04.1",
"0.103.6+dfsg-0ubuntu0.20.04.1",
"0.103.8+dfsg-0ubuntu0.20.04.1",
"0.103.9+dfsg-0ubuntu0.20.04.1",
"0.103.11+dfsg-0ubuntu0.20.04.1",
"0.103.12+dfsg-0ubuntu0.20.04.1",
"1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-20337"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.22.04.1"
}
]
}
],
"release": "22.04",
"versions": [
"0.103.3+dfsg-1",
"0.103.4+dfsg-1",
"0.103.4+dfsg-1build1",
"0.103.5+dfsg-1",
"0.103.6+dfsg-0ubuntu0.22.04.1",
"0.103.8+dfsg-0ubuntu0.22.04.1",
"0.103.9+dfsg-0ubuntu0.22.04.1",
"0.103.11+dfsg-0ubuntu0.22.04.1",
"0.103.12+dfsg-0ubuntu0.22.04.1",
"1.4.3+dfsg-0ubuntu0.22.04.1",
"1.4.4+dfsg-0ubuntu0.22.04.1",
"1.5.3+dfsg-0ubuntu0.22.04.2"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.22.04.1",
"provider_record_id": "UBUNTU-CVE-2026-20337"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.24.04.1"
}
]
}
],
"release": "24.04",
"versions": [
"1.0.2+dfsg-1ubuntu1",
"1.0.3+dfsg-2ubuntu1",
"1.0.4+dfsg-0ubuntu1",
"1.0.5+dfsg-1ubuntu1",
"1.0.5+dfsg-1.1ubuntu2",
"1.0.5+dfsg-1.1ubuntu3",
"1.0.7+dfsg-0ubuntu0.24.04.1",
"1.0.8+dfsg-0ubuntu0.24.04.1",
"1.4.3+dfsg-0ubuntu0.24.04.1",
"1.4.4+dfsg-0ubuntu0.24.04.1",
"1.5.3+dfsg-0ubuntu0.24.04.1"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.24.04.1",
"provider_record_id": "UBUNTU-CVE-2026-20337"
},
{
"name": "clamav",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4+dfsg-0ubuntu0.26.04.1"
}
]
}
],
"release": "26.04",
"versions": [
"1.4.3+dfsg-0ubuntu2",
"1.4.3+dfsg-0ubuntu3",
"1.4.3+dfsg-2ubuntu1",
"1.4.3+dfsg-2ubuntu2",
"1.4.3+dfsg-2ubuntu3",
"1.4.4+dfsg-0ubuntu0.26.04.1",
"1.5.3+dfsg-0ubuntu0.26.04.1",
"1.5.3+dfsg-0ubuntu0.26.04.2"
],
"ecosystem": "deb",
"fixed_version": "1.5.4+dfsg-0ubuntu0.26.04.1",
"provider_record_id": "UBUNTU-CVE-2026-20337"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise micro 5.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise server 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise server 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150400.13.11.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150400.13.11.1",
"provider_record_id": "SUSE-SU-2026:4208-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150600.18.31.1"
}
]
}
],
"release": "linux enterprise module for basesystem 15 sp7",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150600.18.31.1",
"provider_record_id": "SUSE-SU-2026:4180-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150600.18.31.1"
}
]
}
],
"release": "linux enterprise server 15 sp6-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150600.18.31.1",
"provider_record_id": "SUSE-SU-2026:4180-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-150600.18.31.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-150600.18.31.1",
"provider_record_id": "SUSE-SU-2026:4180-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-3.59.1"
}
]
}
],
"release": "linux enterprise server 12 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-3.59.1",
"provider_record_id": "SUSE-SU-2026:4179-1"
},
{
"name": "clamav",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-3.59.1"
}
]
}
],
"release": "linux enterprise server ltss extended security 12 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-3.59.1",
"provider_record_id": "SUSE-SU-2026:4179-1"
},
{
"name": "clamav",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-160000.1.1"
}
]
}
],
"release": "leap 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-160000.1.1",
"provider_record_id": "OPENSUSE-SU-2026:21831-1"
},
{
"name": "clamav",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.5.4-1.1",
"provider_record_id": "OPENSUSE-SU-2026:11583-1"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[openSUSE Tumbleweed]
- [clamav]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedFixed · Fixed:
1.5.4-1.1nvd · clamav · opensuse · tumbleweed
- [clamav-devel]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
- [clamav-docs-html]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· noarch · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
- [clamav-milter]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
- [libclamav12]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
- [libclammspack0]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
- [libfreshclam4]Unknown
Source package: [clamav]
Details (1)
1.5.4-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.5.4-1.1Version impact unknown
nvd · clamav · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11583-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-20337]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23706-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23727-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4179-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4180-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4208-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-20337]
- [https://osv.dev/vulnerability/USN-8788-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11583-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21831-1]
- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26]
- [https://ubuntu.com/security/notices/USN-8788-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2708.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]