UBUNTU-CVE-2026-20214

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-20214
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-20214
Upstream
  • CVE-2026-20214
Downstream
Related
Published
2026-07-02T00:00:00Z
Modified
2026-07-09T17:15:50.362633069Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

References

Affected packages

Ubuntu:22.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.22.04.2

Affected versions

0.*
0.103.3+dfsg-1
0.103.4+dfsg-1
0.103.4+dfsg-1build1
0.103.5+dfsg-1
0.103.6+dfsg-0ubuntu0.22.04.1
0.103.8+dfsg-0ubuntu0.22.04.1
0.103.9+dfsg-0ubuntu0.22.04.1
0.103.11+dfsg-0ubuntu0.22.04.1
0.103.12+dfsg-0ubuntu0.22.04.1
1.*
1.4.3+dfsg-0ubuntu0.22.04.1
1.4.4+dfsg-0ubuntu0.22.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:24.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.24.04.1

Affected versions

1.*
1.0.2+dfsg-1ubuntu1
1.0.3+dfsg-2ubuntu1
1.0.4+dfsg-0ubuntu1
1.0.5+dfsg-1ubuntu1
1.0.5+dfsg-1.1ubuntu2
1.0.5+dfsg-1.1ubuntu3
1.0.7+dfsg-0ubuntu0.24.04.1
1.0.8+dfsg-0ubuntu0.24.04.1
1.4.3+dfsg-0ubuntu0.24.04.1
1.4.4+dfsg-0ubuntu0.24.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:25.10
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.2+dfsg-0ubuntu1
1.4.2+dfsg-0ubuntu2
1.4.2+dfsg-1ubuntu1
1.4.3+dfsg-0ubuntu1
1.4.3+dfsg-0ubuntu2
1.4.4+dfsg-0ubuntu0.25.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:26.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.26.04.1

Affected versions

1.*
1.4.3+dfsg-0ubuntu2
1.4.3+dfsg-0ubuntu3
1.4.3+dfsg-2ubuntu1
1.4.3+dfsg-2ubuntu2
1.4.3+dfsg-2ubuntu3
1.4.4+dfsg-0ubuntu0.26.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:Pro:14.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.8+dfsg-1ubuntu4
0.97.8+dfsg-1ubuntu5
0.98.1+dfsg-1ubuntu4
0.98.1+dfsg-1ubuntu5
0.98.1+dfsg-2ubuntu2
0.98.1+dfsg-4ubuntu1
0.98.1+dfsg-4ubuntu1.1
0.98.5+addedllvm-0ubuntu0.14.04.1
0.98.6+dfsg-0ubuntu0.14.04.1
0.98.7+dfsg-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.2
0.99.3+addedllvm-0ubuntu0.14.04.1
0.99.4+addedllvm-0ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.2
0.100.1+dfsg-1ubuntu0.14.04.3
0.100.1+dfsg-1ubuntu0.14.04.4
0.100.2+dfsg-1ubuntu0.14.04.1
0.100.2+dfsg-1ubuntu0.14.04.2
0.100.3+dfsg-0ubuntu0.14.04.1
0.100.3+dfsg-0ubuntu0.14.04.1+esm1
0.101.4+dfsg-0ubuntu0.14.04.1+esm1
0.102.1+dfsg-0ubuntu0.14.04.1+esm1
0.102.2+dfsg-0ubuntu0.14.04.1+esm1
0.102.3+dfsg-0ubuntu0.14.04.1+esm1
0.102.4+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm2
0.103.5+dfsg-0ubuntu0.14.04.1+esm1
0.103.6+dfsg-0ubuntu0.14.04.1+esm1
0.103.8+dfsg-0ubuntu0.14.04.1+esm1
0.103.9+dfsg-0ubuntu0.14.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:Pro:16.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.98.7+dfsg-0ubuntu4
0.98.7+dfsg-0ubuntu5
0.99+dfsg-1ubuntu1
0.99+dfsg-1ubuntu1.1
0.99+dfsg-1ubuntu1.2
0.99.2+dfsg-0ubuntu0.16.04.1
0.99.2+dfsg-0ubuntu0.16.04.2
0.99.2+dfsg-0ubuntu0.16.04.3
0.99.3+addedllvm-0ubuntu0.16.04.1
0.99.4+addedllvm-0ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.2
0.100.1+dfsg-1ubuntu0.16.04.3
0.100.2+dfsg-1ubuntu0.16.04.1
0.100.3+dfsg-0ubuntu0.16.04.1
0.101.4+dfsg-0ubuntu0.16.04.1
0.102.1+dfsg-0ubuntu0.16.04.2
0.102.2+dfsg-0ubuntu0.16.04.1
0.102.3+dfsg-0ubuntu0.16.04.1
0.102.4+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1+esm1
0.103.5+dfsg-0ubuntu0.16.04.1+esm1
0.103.6+dfsg-0ubuntu0.16.04.1+esm1
0.103.8+dfsg-0ubuntu0.16.04.1+esm1
0.103.9+dfsg-0ubuntu0.16.04.1+esm1
0.103.12+dfsg-0ubuntu0.16.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:Pro:18.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.99.2+dfsg-6ubuntu2
0.99.3~beta1+dfsg-2ubuntu1
0.99.3~beta1+dfsg-2ubuntu2
0.99.3+addedllvm-0ubuntu1
0.99.3+addedllvm-0ubuntu2
0.99.4+addedllvm-0ubuntu1
0.100.1+dfsg-1ubuntu0.18.04.1
0.100.1+dfsg-1ubuntu0.18.04.2
0.100.1+dfsg-1ubuntu0.18.04.3
0.100.2+dfsg-1ubuntu0.18.04.1
0.100.3+dfsg-0ubuntu0.18.04.1
0.101.4+dfsg-0ubuntu0.18.04.1
0.102.1+dfsg-0ubuntu0.18.04.2
0.102.2+dfsg-0ubuntu0.18.04.1
0.102.3+dfsg-0ubuntu0.18.04.1
0.102.4+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.2
0.103.2+dfsg-0ubuntu0.18.04.3
0.103.5+dfsg-0ubuntu0.18.04.1
0.103.6+dfsg-0ubuntu0.18.04.1
0.103.8+dfsg-0ubuntu0.18.04.1
0.103.9+dfsg-0ubuntu0.18.04.1+esm1
0.103.12+dfsg-0ubuntu0.18.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        },
        {
            "binary_name": "libclamav9",
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"
Ubuntu:Pro:20.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.101.4+dfsg-1ubuntu1
0.102.1+dfsg-1ubuntu1
0.102.1+dfsg-2ubuntu1
0.102.1+dfsg-2ubuntu2
0.102.2+dfsg-1ubuntu1
0.102.2+dfsg-2ubuntu1
0.102.3+dfsg-0ubuntu0.20.04.1
0.102.4+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.2
0.103.5+dfsg-1~20.04.1
0.103.6+dfsg-0ubuntu0.20.04.1
0.103.8+dfsg-0ubuntu0.20.04.1
0.103.9+dfsg-0ubuntu0.20.04.1
0.103.11+dfsg-0ubuntu0.20.04.1
0.103.12+dfsg-0ubuntu0.20.04.1
1.*
1.4.3+dfsg-0ubuntu0.20.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "clamav",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-base",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-daemon",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-docs",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-freshclam",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-milter",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamav-testfiles",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "clamdscan",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        },
        {
            "binary_name": "libclamav12",
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20214.json"