ClamAV (versions affected across multiple release branches)
ClamAV is a free, open-source antivirus scanning engine maintained by Cisco's Talos group, widely used inside email gateways, file upload systems, and security tooling at organisations of all sizes.
Root Cause
The parser fails to validate the substream count before using it to calculate memory allocation size. A value crafted to be unexpectedly large causes the system to allocate insufficient space, after which the parser writes beyond that space when reading the archive's contents. The developer did not enforce an upper bound on the count before allocation.
Attack Vector
An attacker crafts a malformed 7z archive and submits it to any service that scans files with ClamAV — an email attachment, a file upload form, or a shared folder under active monitoring. When ClamAV processes the file, the malformed substream count triggers the overflow. Depending on what sits in adjacent memory, this could crash the scanner or potentially be developed into code execution.
Detection Notes
Monitor for unexpected ClamAV process crashes or restarts. Look for scan jobs that terminate without producing a result on 7z files specifically. Unusual volumes of malformed archive submissions from a single source are worth investigating.
Recommended Actions
- Upgrade ClamAV to version 1.5.3 (recommended) or 1.4.5 immediately — both are available on the ClamAV GitHub releases page.
- If immediate patching is not possible, restrict ClamAV from scanning untrusted 7z archives at the gateway level as a temporary measure.
- Enable logging for scanner crashes and set up alerts if the ClamAV daemon exits unexpectedly.