Back Linuxsecurity

SUSE clamav Important Security Fix Advisory 2026-4180

Linuxsecurity •LinuxSecurity Advisories • September 15, 2026

Artifactory Alert: Chained flaws let attackers gain admin control. Check your version now ×

## This update for clamav fixes the following issues: * CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597). * CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records (bsc#1274598). * CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-bounds write (bsc#1274599). * CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names (bsc#1274600). * CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601). * CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a crash (bsc#1274602).

* CVE-2025-8088 ( NVD ): 8.4

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

* CVE-2025-8088 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

* CVE-2026-20337 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-20337 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Announcement ID: SUSE-SU-2026:4180-1 Release Date: 2026-09-14T14:49:34Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in ClamAV Affecting Multiple File Parsers SUSE has issued important security advisories for ClamAV, addressing multiple denial of service vulnerabilities. The vulnerabilities, identified as CVE-2026-20213 through CVE-2026-20217 and CVE-2026-20337 through CVE-2026-20347, allow unauthenticated remote attackers to exploit flaws in various file format parsers, including PE, FSG, 7z, InstallShield, and ZIP. The affected systems include ClamAV versions prior to the latest updates. Attackers can gain admin control through chained exploits, raising significant security concerns. The vulnerabilities were published between July and August 2026, with some having proof-of-concept code available. Administrators are urged to update their ClamAV installations immediately to mitigate risks. The current status indicates that these vulnerabilities are actively being exploited. 3 sources 73

Extracted Entities

CVEs (7)

CVE-2025-8088 CVE-2026-20337 CVE-2026-20338 CVE-2026-20339 CVE-2026-20345 CVE-2026-20346 CVE-2026-20347

CWE Weaknesses (4)

Cwe-125 - Out-of-bounds Read Cwe-190 - Integer Overflow Or Wraparound Cwe-191 - Integer Underflow Cwe-787 - Out-of-bounds Write