CVE-2005-3500: Clam Anti-Virus Clamav

Medium severity, CVSS 5.0. EPSS: 4% chance of exploitation in the next 30 days.

The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.

Affected products

• Clam Anti-Virus Clamav: version 0.15 only; version 0.20 only; version 0.21 only; version 0.22 only; version 0.23 only; version 0.24 only; …

Published 2005-11-05. Last modified 2026-06-16.