CVE-2026-20346

Name	CVE-2026-20346
Description	A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1143939

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	bullseye	0.103.10+dfsg-0+deb11u1	vulnerable
	bullseye (security)	1.4.3+dfsg-1~deb11u1	vulnerable
	bookworm	1.4.3+dfsg-1~deb12u2	vulnerable
	trixie	1.4.3+dfsg-1	vulnerable
	forky, sid	1.4.5+dfsg-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
clamav	source	(unstable)	(unfixed)			1143939

[trixie] - clamav <no-dsa> (clamav is being updated via -updates)
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html