CVE-2010-1640: Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers t...

Security readout for executives and security teams

CVE-2010-1640 is a denial-of-service flaw in ClamAV 0.96. A specially crafted Windows PE file icon can crash the scanner. The main business risk is interruption of malware scanning on systems that inspect untrusted files, especially mail gateways or upload pipelines. Likely exposed systems run ClamAV 0.96 or affected downstream packages and scan attacker-controlled PE files. Common exposure points include email attachment scanning, file upload scanning, shared file repositories, and malware triage workflows. The bundle does not identify CPEs or all affected distributions. Prioritize remediation where ClamAV protects inbound mail, uploads, or shared storage. This is not evidenced as code execution, but a scanner crash can weaken malware defenses and disrupt security operations. Mitigation focus: Identify any ClamAV 0.96 installations or affected vendor packages.; Review ClamAV and OS vendor advisories for the fixed package level.; Upgrade to a vendor-fixed ClamAV package where applicable..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.