CVE-2008-1836: Clam Anti-Virus Clamav

Medium severity, CVSS 4.3. EPSS: 3.5% chance of exploitation in the next 30 days.

The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via a crafted message that produces a string that is not null terminated, which triggers a buffer over-read.

Affected products

• Clam Anti-Virus Clamav: version 0.90 only; version 0.90.1 only; version 0.90_rc1.1 only; version 0.90_rc2 only; version 0.90_rc3 only; version 0.90rc1 only; …

Published 2008-04-16. Last modified 2026-06-16.