Login Request a demo
Medium severity · published Mar 19, 2021
CVE-2021-27506
The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files
5.5
CVSS
1.3%
EPSS
No
On KEV
Description
The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Clamav · Clamav
through 0.103.1 · source: NVD
NE
Netasq · Netasq Project
9.1.0 through 9.1.11 · source: NVD
SN
Stormshield Network Security · Stormshield
1.0 through 4.2.0 · source: NVD
Affected product
CL
Clamav
Clamav
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27506
Broken Link
https://advisories.stormshield.eu/2021-003/
Vendor Advisory
https://blog.clamav.net/2021/02/clamav-01031-patch-release.html
More from Clamav
9.8
CVE-2025-20260
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS)…
9.8
CVE-2023-20032
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and…
9.8
CVE-2013-7088
ClamAV before 0.97.7 has buffer overflow in the libclamav component
9.8
CVE-2013-7087
ClamAV before 0.97.7 has WWPack corrupt heap memory
9.8
CVE-2007-6745
clamav 0.91.2 suffers from a floating point exception when using ScanOLE2