Heap-buffer-overflow in cli_bcomp_freemeta in ClamAV

clamav Updated 02 Oct 2025

Summary

15/04/2022

Disclosed on

MEDIUM

Severity

Yes i

Fix available

Medium

Severity

Not published

CVSS Score

OSV-2022-347: Heap-buffer-overflow in cli_bcomp_freemeta. Affects clamav versions >= 0037f5825b0b17a789c7eb29c9cb9a2d39c452bc, < d6d7f183bf9c172c0a01f92c16df0ddbf33b05cc. Fixed in d6d7f183bf9c172c0a01f92c16df0ddbf33b05cc. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

ClamAV is an open-source antivirus engine designed to detect malicious software. It is widely used to scan files and emails for potential threats. The vulnerability in question, identified as OSV-2022-347, affects the ClamAV package. This vulnerability is categorized as a heap-buffer-overflow, which occurs when a program tries to read or write data outside the bounds of a dynamically allocated buffer in the heap memory. This specific vulnerability occurs in the cli_bcomp_freemeta function of ClamAV, leading to a heap-buffer-overflow read of 8 bytes.

Vulnerability Detail

The vulnerability arises in the cli_bcomp_freemeta function of ClamAV. When processing certain inputs, a heap-buffer-overflow read of 8 bytes occurs. This can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability was reported through the OSS-Fuzz project, and more details can be found in the associated bug report (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46687). The severity of this vulnerability is classified as MEDIUM.

How To Fix

Minimum fixed version

d6d7f183bf9c172c0a01f92c16df0ddbf33b05cc

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

At present, no specific workaround has been provided for this vulnerability.

Conclusion

In conclusion, the ClamAV package is affected by a heap-buffer-overflow vulnerability in the cli_bcomp_freemeta function. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition. To mitigate the risk, it is recommended to update the ClamAV package to a version that includes the fix. For further assistance or support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for clamav →