How many CVEs does clamav have?

clamav has 106 published CVE records since 2005, including 11 in the last two years.

How many clamav CVEs are in CISA KEV?

None of clamav's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which clamav products have the most CVEs?

The clamav products with the most published CVEs are clamav, ClamBC.

What are the most common weakness types in clamav CVEs?

clamav's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-399.

Are there public exploits for clamav vulnerabilities?

Yes — 18 of clamav's CVEs have a known public exploit.

How many critical clamav vulnerabilities are there?

clamav has 15 critical and 43 high-severity CVEs.

What is the average severity of clamav CVEs?

The average CVSS base score across clamav's scored CVEs is 6.7.

RadicalNotion.AI

Log in Create an account

106 CVEs

clamav Vulnerabilities

Name: clamav vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for clamav.

106

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

18

Public exploits

PoC or exploit code

6.7

Avg CVSS

2005–2026

Overview

clamav has 106 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 18 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.

Security scorecard

A quick read on clamav's vulnerability posture, as a share of its 106 published CVEs.

Average CVSS: 6.7
Critical / high: 55%
Actively exploited (KEV): 0%
Public exploit available: 17%
Patch available: 97%

Severity and exploitation

How the CVSS severity of clamav's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical15

High43

Medium46

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of clamav's CVEs are currently listed in CISA's KEV catalog.

Public exploits

18

18 of clamav's CVEs have a known public exploit available.

Most affected products

The clamav products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in clamav CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish clamav CVE records.

Disclosure activity by year

How many clamav CVEs were published each year.

2019

12

2020

3

2021

4

2022

6

2023

3

2024

4

2025

3

2026

8

Latest clamav CVEs

The most recently disclosed vulnerabilities affecting clamav.

ClamAV ALZ Archive Processing Denial of Service Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV DMG File Processing Denial of Service Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability
CWE-770
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CWE-120
High · CVSS 7.5
EPSS 0.6%2026-07-01
ClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error
High · CVSS 8.6
EPSS 0.2%2026-02-12
ClamAV PDF Scanning Buffer Overflow Vulnerability
CWE-122
Critical · CVSS 9.8
EPSS 1.6%2025-06-18
ClamAV UDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
CWE-125
High · CVSS 7.5
EPSS 0.8%2025-06-18
ClamAV OLE2 File Format Decryption Denial of Service Vulnerability
CWE-122
High · CVSS 7.5
EPSS 1.6%2025-01-22
ClamAV Privilege Handling Escalation Vulnerability
CWE-754
Medium · CVSS 6.1
EPSS 0.3%2024-09-04

Get an alert for each new clamav CVE, with AI-written analysis and remediation steps.

Monitor clamav CVEs

Other vendors

CVE counts for other vendors.

Mikrotik107 CVEs Bitdefender107 CVEs zzcms107 CVEs TryGhost106 CVEs Webkul106 CVEs Ashlar-Vellum105 CVEs ethereal group105 CVEs salesagility105 CVEs

Browse all vendors

Frequently asked questions

Common questions about clamav vulnerabilities.

How many CVEs does clamav have?: clamav has 106 published CVE records since 2005, including 11 in the last two years.
How many clamav CVEs are in CISA KEV?: None of clamav's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which clamav products have the most CVEs?: The clamav products with the most published CVEs are clamav, ClamBC.
What are the most common weakness types in clamav CVEs?: clamav's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-125 (Out-of-bounds Read), CWE-399.
Are there public exploits for clamav vulnerabilities?: Yes — 18 of clamav's CVEs have a known public exploit.
How many critical clamav vulnerabilities are there?: clamav has 15 critical and 43 high-severity CVEs.
What is the average severity of clamav CVEs?: The average CVSS base score across clamav's scored CVEs is 6.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track clamav vulnerabilities

Get an alert for each new clamav CVE, with AI-written analysis and remediation steps.

Create an account See pricing