ClamAV ZIP Archive Parser Double-Free Denial of Service

Successful exploitation can cause the ClamAV scanning process to terminate, resulting in a denial-of-service condition and interruption of malware scanning operations. This can reduce availability of antivirus services on affected systems and may prevent inspection of submitted content until the service is restarted or otherwise recovered.

If immediate patching is not possible, reduce exposure by limiting who can submit files for scanning, especially untrusted remote users or external content pipelines that automatically pass ZIP archives to ClamAV. Apply input filtering and operational controls to restrict or isolate scanning of untrusted malformed archives, and monitor the scanning service for crashes so it can be automatically restarted. These measures only reduce exploitability and operational impact; they do not eliminate the underlying flaw.

Upgrade ClamAV to version 1.5.4 or later. For downstream products that embed or ship ClamAV, apply the vendor-provided updates that incorporate the fixed ClamAV release. Affected deployments on the 1.5 branch should prioritize patching because public proof-of-concept code has been reported as available.