PatchTheCVEclamav vulnerabilities
Recent CVEs affecting clamav products. 7 tracked.
clamav has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-07-01. Highest priority: CVE-2026-20213 (score 43/100).
- CVE-2026-20213 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to caus
- CVE-2026-20214 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
- CVE-2026-20215 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to caus
- CVE-2026-20216 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attac
- CVE-2026-20217 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to
- CVE-2026-20243 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
- CVE-2026-20244 HIGH 7.5 UPGRADE UPGRADE A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cau
FAQ
How do I fix clamav vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is clamav being exploited right now?
None of the tracked clamav CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which clamav CVE should I patch first?
CVE-2026-20213 currently ranks highest (43/100): A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to caus.