CVE-2006-4182Clamav Vulnerability
Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when…
Published Oct 16, 2006 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2006-4182, DSA-1196-1
Key Facts
Patch immediately- CVE-2006-4182 is a high-severity vulnerability (CVSS 7.5 v2) affecting Clamav (Clam Anti-Virus), clamav-devel (suse), clamav-milter (suse) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 21% probability of exploitation in the next 30 days.
- Fixed versions are available, including Clamav 0.88.4, Clamav 0.103.3-1.4, Clamav 0.84-2.sarge.11.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
21%
Higher than 97.5% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
34/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.
Affected Products
64 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ClamavClam Anti-Virus | ., 0.15, 0.20, 0.21, 0.22, 0.23, 0.24, 0.51 | 0.88.4 |
| clamav-develsuse | See advisory | 0.103.3-1.4 |
| clamav-miltersuse | See advisory | 0.103.3-1.4 |
| libclamav9suse | See advisory | 0.103.3-1.4 |
| libfreshclam2suse | See advisory | 0.103.3-1.4 |
Patched Releases
Clamav
0.88.4, 0.103.3-1.4, 0.84-2.sarge.11, 0.88.5-1
clamav-devel
0.103.3-1.4
clamav-milter
0.103.3-1.4
libclamav9
0.103.3-1.4
libfreshclam2
0.103.3-1.4
Timeline
Publicly disclosed
Oct 16, 2006
Last updated
Aug 4, 2026
References
- advisorysecurity-tracker.debian.org · CVE-2006-4182
- patch20061016 Clam AntiVirus ClamAV rebuildpe Heap Overflow Vulnerability
- exploitExploitDB-2587
- otherdocs.info.apple.com · article.html
- otherkolab.org · kolab-vendor-notice-13.txt
FAQ
Common Questions.
Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.
Affected: Clamav (Clam Anti-Virus) versions ., 0.15, 0.20, 0.21, 0.22, 0.23, 0.24, 0.51; clamav-devel (suse); clamav-milter (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Clamav 0.88.4, Clamav 0.103.3-1.4, Clamav 0.84-2.sarge.11.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2006-4182 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo