ALAS2-2026-3894: CVEs fixed (Amazon Linux)

ALAS2-2026-3894 fixes 5 tracked CVEs. Affected systems and fixed versions.

CVE-2026-20348 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
CVE-2026-20339 HIGH 7.5 A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to
CVE-2026-20345 HIGH 7.5 A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
CVE-2026-20346 HIGH 7.5 A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
CVE-2026-20347 HIGH 7.5 A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to

Applies to