UBUNTU-CVE-2026-20213

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-20213
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-20213
Upstream
  • CVE-2026-20213
Downstream
Related
Published
2026-07-02T00:00:00Z
Modified
2026-07-09T17:15:31.082291967Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

References

Affected packages

Ubuntu:22.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.22.04.2

Affected versions

0.*
0.103.3+dfsg-1
0.103.4+dfsg-1
0.103.4+dfsg-1build1
0.103.5+dfsg-1
0.103.6+dfsg-0ubuntu0.22.04.1
0.103.8+dfsg-0ubuntu0.22.04.1
0.103.9+dfsg-0ubuntu0.22.04.1
0.103.11+dfsg-0ubuntu0.22.04.1
0.103.12+dfsg-0ubuntu0.22.04.1
1.*
1.4.3+dfsg-0ubuntu0.22.04.1
1.4.4+dfsg-0ubuntu0.22.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:24.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.24.04.1

Affected versions

1.*
1.0.2+dfsg-1ubuntu1
1.0.3+dfsg-2ubuntu1
1.0.4+dfsg-0ubuntu1
1.0.5+dfsg-1ubuntu1
1.0.5+dfsg-1.1ubuntu2
1.0.5+dfsg-1.1ubuntu3
1.0.7+dfsg-0ubuntu0.24.04.1
1.0.8+dfsg-0ubuntu0.24.04.1
1.4.3+dfsg-0ubuntu0.24.04.1
1.4.4+dfsg-0ubuntu0.24.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:25.10
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.2+dfsg-0ubuntu1
1.4.2+dfsg-0ubuntu2
1.4.2+dfsg-1ubuntu1
1.4.3+dfsg-0ubuntu1
1.4.3+dfsg-0ubuntu2
1.4.4+dfsg-0ubuntu0.25.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:26.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.26.04.1

Affected versions

1.*
1.4.3+dfsg-0ubuntu2
1.4.3+dfsg-0ubuntu3
1.4.3+dfsg-2ubuntu1
1.4.3+dfsg-2ubuntu2
1.4.3+dfsg-2ubuntu3
1.4.4+dfsg-0ubuntu0.26.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:Pro:14.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.8+dfsg-1ubuntu4
0.97.8+dfsg-1ubuntu5
0.98.1+dfsg-1ubuntu4
0.98.1+dfsg-1ubuntu5
0.98.1+dfsg-2ubuntu2
0.98.1+dfsg-4ubuntu1
0.98.1+dfsg-4ubuntu1.1
0.98.5+addedllvm-0ubuntu0.14.04.1
0.98.6+dfsg-0ubuntu0.14.04.1
0.98.7+dfsg-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.2
0.99.3+addedllvm-0ubuntu0.14.04.1
0.99.4+addedllvm-0ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.2
0.100.1+dfsg-1ubuntu0.14.04.3
0.100.1+dfsg-1ubuntu0.14.04.4
0.100.2+dfsg-1ubuntu0.14.04.1
0.100.2+dfsg-1ubuntu0.14.04.2
0.100.3+dfsg-0ubuntu0.14.04.1
0.100.3+dfsg-0ubuntu0.14.04.1+esm1
0.101.4+dfsg-0ubuntu0.14.04.1+esm1
0.102.1+dfsg-0ubuntu0.14.04.1+esm1
0.102.2+dfsg-0ubuntu0.14.04.1+esm1
0.102.3+dfsg-0ubuntu0.14.04.1+esm1
0.102.4+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm2
0.103.5+dfsg-0ubuntu0.14.04.1+esm1
0.103.6+dfsg-0ubuntu0.14.04.1+esm1
0.103.8+dfsg-0ubuntu0.14.04.1+esm1
0.103.9+dfsg-0ubuntu0.14.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:Pro:16.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.98.7+dfsg-0ubuntu4
0.98.7+dfsg-0ubuntu5
0.99+dfsg-1ubuntu1
0.99+dfsg-1ubuntu1.1
0.99+dfsg-1ubuntu1.2
0.99.2+dfsg-0ubuntu0.16.04.1
0.99.2+dfsg-0ubuntu0.16.04.2
0.99.2+dfsg-0ubuntu0.16.04.3
0.99.3+addedllvm-0ubuntu0.16.04.1
0.99.4+addedllvm-0ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.2
0.100.1+dfsg-1ubuntu0.16.04.3
0.100.2+dfsg-1ubuntu0.16.04.1
0.100.3+dfsg-0ubuntu0.16.04.1
0.101.4+dfsg-0ubuntu0.16.04.1
0.102.1+dfsg-0ubuntu0.16.04.2
0.102.2+dfsg-0ubuntu0.16.04.1
0.102.3+dfsg-0ubuntu0.16.04.1
0.102.4+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1+esm1
0.103.5+dfsg-0ubuntu0.16.04.1+esm1
0.103.6+dfsg-0ubuntu0.16.04.1+esm1
0.103.8+dfsg-0ubuntu0.16.04.1+esm1
0.103.9+dfsg-0ubuntu0.16.04.1+esm1
0.103.12+dfsg-0ubuntu0.16.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:Pro:18.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.99.2+dfsg-6ubuntu2
0.99.3~beta1+dfsg-2ubuntu1
0.99.3~beta1+dfsg-2ubuntu2
0.99.3+addedllvm-0ubuntu1
0.99.3+addedllvm-0ubuntu2
0.99.4+addedllvm-0ubuntu1
0.100.1+dfsg-1ubuntu0.18.04.1
0.100.1+dfsg-1ubuntu0.18.04.2
0.100.1+dfsg-1ubuntu0.18.04.3
0.100.2+dfsg-1ubuntu0.18.04.1
0.100.3+dfsg-0ubuntu0.18.04.1
0.101.4+dfsg-0ubuntu0.18.04.1
0.102.1+dfsg-0ubuntu0.18.04.2
0.102.2+dfsg-0ubuntu0.18.04.1
0.102.3+dfsg-0ubuntu0.18.04.1
0.102.4+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.2
0.103.2+dfsg-0ubuntu0.18.04.3
0.103.5+dfsg-0ubuntu0.18.04.1
0.103.6+dfsg-0ubuntu0.18.04.1
0.103.8+dfsg-0ubuntu0.18.04.1
0.103.9+dfsg-0ubuntu0.18.04.1+esm1
0.103.12+dfsg-0ubuntu0.18.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"
Ubuntu:Pro:20.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.101.4+dfsg-1ubuntu1
0.102.1+dfsg-1ubuntu1
0.102.1+dfsg-2ubuntu1
0.102.1+dfsg-2ubuntu2
0.102.2+dfsg-1ubuntu1
0.102.2+dfsg-2ubuntu1
0.102.3+dfsg-0ubuntu0.20.04.1
0.102.4+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.2
0.103.5+dfsg-1~20.04.1
0.103.6+dfsg-0ubuntu0.20.04.1
0.103.8+dfsg-0ubuntu0.20.04.1
0.103.9+dfsg-0ubuntu0.20.04.1
0.103.11+dfsg-0ubuntu0.20.04.1
0.103.12+dfsg-0ubuntu0.20.04.1
1.*
1.4.3+dfsg-0ubuntu0.20.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20213.json"