CVE-2026-0866 in ClamAV

Summary

by MITRE • 03/18/2026

After the publication of the PoC by the researcher and further analysis, we have determined that this issue does not constitute a valid vulnerability. The technique described is an obfuscation method and does not bypass or impact any implicit or explicit security controls.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Disclosure: 03/18/2026
• Moderation: revoked
• Entry: VDB-350379
• CPE: ready
• CWE: CWE-693 (confirmed)
• Exploit: Download
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low
• Sector: Energy, Lawfirm, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-0866
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0866
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-0866/