CVE-2017-6418

libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

• CWE-125

• http://www.securityfocus.com/bid/100154
• https://bugzilla.clamav.net/show_bug.cgi?id=11797Permissions Required
• https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/heap-overflow/clamav_email_crash.mdThird Party Advisory
• https://github.com/vrtadmin/clamav-devel/commit/586a5180287262070637c8943f2f7efd652e4a2cIssue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201804-16
• http://www.securityfocus.com/bid/100154
• https://bugzilla.clamav.net/show_bug.cgi?id=11797Permissions Required
• https://github.com/varsleak/varsleak-vul/blob/master/clamav-vul/heap-overflow/clamav_email_crash.mdThird Party Advisory
• https://github.com/vrtadmin/clamav-devel/commit/586a5180287262070637c8943f2f7efd652e4a2cIssue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201804-16

Published

Aug 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6412In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixati…
• CVE-2017-6413The "OpenID Connect Relying Party and OAuth 2.0 Resource Ser…
• CVE-2017-6414Memory leak in the vcard_apdu_new function in card_7816.c in…6.5
• CVE-2017-6415The dex_parse_debug_item function in libr/bin/p/bin_dex.c in…5.5
• CVE-2017-6416An issue was discovered in SysGauge 1.5.18. A buffer overflo…
• CVE-2017-6417Code injection vulnerability in Avira Total Security Suite 1…
• CVE-2017-6419mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.…
• CVE-2017-6420The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99…
• CVE-2017-6421In the touch controller function in all Qualcomm products wi…
• CVE-2017-6423An elevation of privilege vulnerability in the Qualcomm kyro…
• CVE-2017-6424An elevation of privilege vulnerability in the Qualcomm WiFi…
• CVE-2017-6425An information disclosure vulnerability in the Qualcomm vide…