CVE-2006-1615: Clamav

High severity, CVSS 10.0. EPSS: 11.6% chance of exploitation in the next 30 days.

Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.

Affected products

• Clamav Clamav: up to and including 0.88; version 0.01 only; version 0.02 only; version 0.3 only; version 0.03 only; version 0.05 only; …

Published 2006-04-06. Last modified 2026-06-16.