Cisco has released new versions of the free antivirus package ClamAV 1.4.6 and 1.5.4, which fix vulnerabilities, some of which could allow an attacker to execute code when scanning specially crafted content.
- CVE-2026-20337 — buffer overflow when handling specially crafted ZIP archive headers.
- CVE-2026-20345 — buffer overflow for reading and writing when processing invalid GPT partition names.
- CVE-2026-20339 — integer overflow in the PESpin decompressor, leading to a buffer overflow when scanning a PE file.
- CVE-2026-20338 — use-after-free memory access in the ZIP archive handler.
- CVE-2026-20346 — integer overflow in the PDF format parser.
- CVE-2026-20347 — integer overflow in the Mach-O executable file parser.
- CVE-2026-20348 — exhaustion of available memory when parsing specially crafted XAR files.
- CVE-2025-8088 — extraction of files to a location outside the root of the temporary directory when processing specially crafted RAR archives on the Windows platform.
Source: opennet.ru
