UBUNTU-CVE-2026-20217

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-20217
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-20217
Upstream
Downstream
Related
Published
2026-07-02T00:00:00Z
Modified
2026-07-09T17:16:14.156700355Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

References

Affected packages

Ubuntu:22.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.22.04.2

Affected versions

0.*
0.103.3+dfsg-1
0.103.4+dfsg-1
0.103.4+dfsg-1build1
0.103.5+dfsg-1
0.103.6+dfsg-0ubuntu0.22.04.1
0.103.8+dfsg-0ubuntu0.22.04.1
0.103.9+dfsg-0ubuntu0.22.04.1
0.103.11+dfsg-0ubuntu0.22.04.1
0.103.12+dfsg-0ubuntu0.22.04.1
1.*
1.4.3+dfsg-0ubuntu0.22.04.1
1.4.4+dfsg-0ubuntu0.22.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.22.04.2",
            "binary_name": "libclamav12"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:24.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.24.04.1

Affected versions

1.*
1.0.2+dfsg-1ubuntu1
1.0.3+dfsg-2ubuntu1
1.0.4+dfsg-0ubuntu1
1.0.5+dfsg-1ubuntu1
1.0.5+dfsg-1.1ubuntu2
1.0.5+dfsg-1.1ubuntu3
1.0.7+dfsg-0ubuntu0.24.04.1
1.0.8+dfsg-0ubuntu0.24.04.1
1.4.3+dfsg-0ubuntu0.24.04.1
1.4.4+dfsg-0ubuntu0.24.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.24.04.1",
            "binary_name": "libclamav12"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:25.10
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.2+dfsg-0ubuntu1
1.4.2+dfsg-0ubuntu2
1.4.2+dfsg-1ubuntu1
1.4.3+dfsg-0ubuntu1
1.4.3+dfsg-0ubuntu2
1.4.4+dfsg-0ubuntu0.25.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "1.4.4+dfsg-0ubuntu0.25.10.1",
            "binary_name": "libclamav12"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:26.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.3+dfsg-0ubuntu0.26.04.1

Affected versions

1.*
1.4.3+dfsg-0ubuntu2
1.4.3+dfsg-0ubuntu3
1.4.3+dfsg-2ubuntu1
1.4.3+dfsg-2ubuntu2
1.4.3+dfsg-2ubuntu3
1.4.4+dfsg-0ubuntu0.26.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "1.5.3+dfsg-0ubuntu0.26.04.1",
            "binary_name": "libclamav12"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:Pro:14.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.97.8+dfsg-1ubuntu4
0.97.8+dfsg-1ubuntu5
0.98.1+dfsg-1ubuntu4
0.98.1+dfsg-1ubuntu5
0.98.1+dfsg-2ubuntu2
0.98.1+dfsg-4ubuntu1
0.98.1+dfsg-4ubuntu1.1
0.98.5+addedllvm-0ubuntu0.14.04.1
0.98.6+dfsg-0ubuntu0.14.04.1
0.98.7+dfsg-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.1
0.99.2+addedllvm-0ubuntu0.14.04.2
0.99.3+addedllvm-0ubuntu0.14.04.1
0.99.4+addedllvm-0ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.1
0.100.1+dfsg-1ubuntu0.14.04.2
0.100.1+dfsg-1ubuntu0.14.04.3
0.100.1+dfsg-1ubuntu0.14.04.4
0.100.2+dfsg-1ubuntu0.14.04.1
0.100.2+dfsg-1ubuntu0.14.04.2
0.100.3+dfsg-0ubuntu0.14.04.1
0.100.3+dfsg-0ubuntu0.14.04.1+esm1
0.101.4+dfsg-0ubuntu0.14.04.1+esm1
0.102.1+dfsg-0ubuntu0.14.04.1+esm1
0.102.2+dfsg-0ubuntu0.14.04.1+esm1
0.102.3+dfsg-0ubuntu0.14.04.1+esm1
0.102.4+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm1
0.103.2+dfsg-0ubuntu0.14.04.1+esm2
0.103.5+dfsg-0ubuntu0.14.04.1+esm1
0.103.6+dfsg-0ubuntu0.14.04.1+esm1
0.103.8+dfsg-0ubuntu0.14.04.1+esm1
0.103.9+dfsg-0ubuntu0.14.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "0.103.9+dfsg-0ubuntu0.14.04.1+esm1",
            "binary_name": "libclamav9"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:Pro:16.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.98.7+dfsg-0ubuntu4
0.98.7+dfsg-0ubuntu5
0.99+dfsg-1ubuntu1
0.99+dfsg-1ubuntu1.1
0.99+dfsg-1ubuntu1.2
0.99.2+dfsg-0ubuntu0.16.04.1
0.99.2+dfsg-0ubuntu0.16.04.2
0.99.2+dfsg-0ubuntu0.16.04.3
0.99.3+addedllvm-0ubuntu0.16.04.1
0.99.4+addedllvm-0ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.1
0.100.1+dfsg-1ubuntu0.16.04.2
0.100.1+dfsg-1ubuntu0.16.04.3
0.100.2+dfsg-1ubuntu0.16.04.1
0.100.3+dfsg-0ubuntu0.16.04.1
0.101.4+dfsg-0ubuntu0.16.04.1
0.102.1+dfsg-0ubuntu0.16.04.2
0.102.2+dfsg-0ubuntu0.16.04.1
0.102.3+dfsg-0ubuntu0.16.04.1
0.102.4+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1
0.103.2+dfsg-0ubuntu0.16.04.1+esm1
0.103.5+dfsg-0ubuntu0.16.04.1+esm1
0.103.6+dfsg-0ubuntu0.16.04.1+esm1
0.103.8+dfsg-0ubuntu0.16.04.1+esm1
0.103.9+dfsg-0ubuntu0.16.04.1+esm1
0.103.12+dfsg-0ubuntu0.16.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.16.04.1+esm1",
            "binary_name": "libclamav9"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:Pro:18.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.99.2+dfsg-6ubuntu2
0.99.3~beta1+dfsg-2ubuntu1
0.99.3~beta1+dfsg-2ubuntu2
0.99.3+addedllvm-0ubuntu1
0.99.3+addedllvm-0ubuntu2
0.99.4+addedllvm-0ubuntu1
0.100.1+dfsg-1ubuntu0.18.04.1
0.100.1+dfsg-1ubuntu0.18.04.2
0.100.1+dfsg-1ubuntu0.18.04.3
0.100.2+dfsg-1ubuntu0.18.04.1
0.100.3+dfsg-0ubuntu0.18.04.1
0.101.4+dfsg-0ubuntu0.18.04.1
0.102.1+dfsg-0ubuntu0.18.04.2
0.102.2+dfsg-0ubuntu0.18.04.1
0.102.3+dfsg-0ubuntu0.18.04.1
0.102.4+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.1
0.103.2+dfsg-0ubuntu0.18.04.2
0.103.2+dfsg-0ubuntu0.18.04.3
0.103.5+dfsg-0ubuntu0.18.04.1
0.103.6+dfsg-0ubuntu0.18.04.1
0.103.8+dfsg-0ubuntu0.18.04.1
0.103.9+dfsg-0ubuntu0.18.04.1+esm1
0.103.12+dfsg-0ubuntu0.18.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "0.103.12+dfsg-0ubuntu0.18.04.1+esm1",
            "binary_name": "libclamav9"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"
Ubuntu:Pro:20.04:LTS
clamav

Package

Name
clamav
Purl
pkg:deb/ubuntu/clamav?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.101.4+dfsg-1ubuntu1
0.102.1+dfsg-1ubuntu1
0.102.1+dfsg-2ubuntu1
0.102.1+dfsg-2ubuntu2
0.102.2+dfsg-1ubuntu1
0.102.2+dfsg-2ubuntu1
0.102.3+dfsg-0ubuntu0.20.04.1
0.102.4+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.1
0.103.2+dfsg-0ubuntu0.20.04.2
0.103.5+dfsg-1~20.04.1
0.103.6+dfsg-0ubuntu0.20.04.1
0.103.8+dfsg-0ubuntu0.20.04.1
0.103.9+dfsg-0ubuntu0.20.04.1
0.103.11+dfsg-0ubuntu0.20.04.1
0.103.12+dfsg-0ubuntu0.20.04.1
1.*
1.4.3+dfsg-0ubuntu0.20.04.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-base"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-daemon"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-docs"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-freshclam"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-milter"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamav-testfiles"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "clamdscan"
        },
        {
            "binary_version": "1.4.3+dfsg-0ubuntu0.20.04.1+esm1",
            "binary_name": "libclamav12"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-20217.json"