CVE-2026-20031

ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability

Published Mar 4, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4852-1 clamav security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Cisco
Cisco secure Endpoint
Vendors & Products Cisco
Cisco secure Endpoint
Type Values Removed Values Added
Description A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.
Title ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability
Weaknesses CWE-248
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Mar 5, 2026, 3:52 PM
Reserved
Oct 8, 2025, 11:59 AM
Status
Undergoing Analysis
Published
Mar 4, 2026, 6:16 PM
Modified
Jun 17, 2026, 10:16 AM