CVE-2026-20216

Name	CVE-2026-20216
Description	A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	bullseye	0.103.10+dfsg-0+deb11u1	vulnerable
	bullseye (security)	1.4.3+dfsg-1~deb11u1	vulnerable
	bookworm	1.4.3+dfsg-1~deb12u2	vulnerable
	trixie	1.4.3+dfsg-1	vulnerable
	forky	1.4.4+dfsg-1	vulnerable
	sid	1.4.4+dfsg-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
clamav	source	(unstable)	(unfixed)

[trixie] - clamav <no-dsa> (clamav is updated via -updates)
https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html