CVE-2007-1745: The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks...

Security readout for executives and security teams

CVE-2007-1745 affects old ClamAV versions before 0.90.2. A crafted CHM file could trigger file descriptor leakage in ClamAV’s CHM unpacking code. The public record does not define the final business impact, so treat this as a legacy exposure check rather than an emergency unless obsolete scanners remain deployed. Exposure is likely limited to systems running ClamAV before 0.90.2, including distributor-packaged ClamAV on older servers, mail gateways, file scanners, or appliances that inspect CHM files. Low to moderate priority for most modern environments, but urgent for legacy mail or file-scanning infrastructure still running obsolete ClamAV packages. Mitigation focus: Inventory ClamAV installations and identify versions earlier than 0.90.2.; Update ClamAV using the applicable vendor or distribution security advisory.; Retire unsupported systems or appliances that embed old ClamAV builds..

Prepared

Jun 29, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.