CVE-2011-2721: Clamav

Medium severity, CVSS 5.0. EPSS: 3.4% chance of exploitation in the next 30 days.

Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.

Affected products

• Clamav Clamav: up to and including 0.97.1; version 0.01 only; version 0.02 only; version 0.3 only; version 0.03 only; version 0.05 only; …

Published 2011-08-05. Last modified 2026-06-16.