CVE-2008-1389: Clam Anti-Virus Clamav

Medium severity, CVSS 5.0. EPSS: 3.4% chance of exploitation in the next 30 days.

libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

Affected products

• Clam Anti-Virus Clamav: up to and including 0.93.3; version 0.11 only; version 0.12 only; version 0.13 only; version 0.14 only; version 0.15 only; …

Published 2008-09-04. Last modified 2026-06-16.