CVE-2010-0098: Clamav

High severity, CVSS 10.0. EPSS: 4.9% chance of exploitation in the next 30 days.

ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities.

Affected products

• Clamav Clamav: up to and including 0.96; version 0.01 only; version 0.02 only; version 0.3 only; version 0.03 only; version 0.05 only; …
• Clamavs Clamav: version 0.04 only; version 0.06 only

Published 2010-04-08. Last modified 2026-06-16.