Skip to main content
VulnerabilityPublished Updated

cli_strlcat · Clamav: Heap-buffer-overflow

Affects clamavSource GCVE Database

0
Severity
Medium

Rated by Threat Radar

Data as of 9 Aug 2026, 18:07 UTC

What to do

Affected software

ProductAffectedFixed in
OSS-Fuzzclamavpkg:generic/clamavOther threatsAffected
  • >=e5f001c9ca4175beecd445004a8e01bbdd29579c
  • =clamav-0.105.0-rc
  • =clamav-0.105.0-rc2
  • =clamav-0.104.3
  • =clamav-0.105.0
  • =clamav-0.104.4
  • =clamav-0.105.1
  • =clamav-0.105.2
  • =clamav-1.0.0
  • =clamav-1.0.0-rc
  • =clamav-1.0.0-rc2
  • =clamav-1.0.1
  • =clamav-1.1.0-rc
  • =clamav-1.1.0
  • =clamav-1.2.0-rc
  • =clamav-1.0.2
  • =clamav-1.1.1
  • =clamav-1.0.3
  • =clamav-1.1.2
  • =clamav-1.2.0
  • =clamav-1.0.4
  • =clamav-1.1.3
  • =clamav-1.2.1
  • =clamav-1.3.0-rc
  • =clamav-1.3.0-rc2
  • =clamav-1.0.5
  • =clamav-1.2.2
  • =clamav-1.3.0
  • =clamav-1.0.6
  • =clamav-1.2.3
  • =clamav-1.3.1
  • =clamav-1.4.0-rc
  • =clamav-1.4.0
  • =clamav-1.0.7
  • =clamav-1.3.2
  • =clamav-1.4.1
  • =clamav-1.0.8
  • =clamav-1.4.2
  • =clamav-1.5.0-beta
  • =clamav-1.0.9
  • =clamav-1.4.3
  • =clamav-1.5.0-rc
  • =clamav-1.5.0
  • =clamav-1.5.1
  • =clamav-1.4.4
  • =clamav-1.5.2
  • =clamav-1.4.5
  • =clamav-1.5.3
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Avoid processing untrusted YARA rules until a fix is available.

Description

A heap-buffer-overflow vulnerability was identified in the ClamAV antivirus software within the cli_strlcat function, as reported by OSS-Fuzz. The issue causes a write overflow on the heap, potentially leading to a crash during YARA rule parsing. No CVSS score or vendor patch information is provided, and no known exploits are reported in the wild. The affected versions include the commit e5f001c9ca4175beecd445004a8e01bbdd29579c and later. The severity is assessed as medium based on the available data.

References

Community reviews

Loading reviews…