Read the docs
TI-2007-00873 Aliases CVE-2007-0897GHSA-3ppm-vmgq-rr54

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain…

Priority LOW 39CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-772.

Summary

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.

Why it matters now

EPSS 0.03495 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*before 0.90VulnerableClamAV
cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*before 10.4.11VulnerableApple
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*3.1VulnerableDebian
  • cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* Versions before 0.90 Vulnerable ·ClamAV
  • cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* Versions before 10.4.11 Vulnerable ·Apple
  • cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-0897
  2. 2026-10-03 Alias added: GHSA-3ppm-vmgq-rr54

References

Advisory 6

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences