The scanner is a parser
Seven ClamAV vulnerabilities were disclosed in August 2026, two of them with public proof-of-concept code, both in the zip parser. The vendor gives one root cause for all seven: unsafe parsing of content an attacker fully controls. A scanner understands twelve file formats, and each one is a parser pointed at hostile input by design.
Seven flaws this month, in the thing whose job is to scan your files.
A malware scanner feels like the safe part of the stack. It inspects danger rather than being exposed to it.
Ask how many file formats it understands. Twelve. Archives, mail, documents, images, executables, presentations.
Each of those is a parser. Each parser exists to open a file that somebody else chose, in a format they chose, containing whatever they wanted.
Two of this month’s seven have working proof-of-concept code, and both sit in the archive parser. The vendor gives one root cause for all seven: unsafe parsing of content the attacker fully controls.
That is the shape of the job. A scanner cannot decline to open hostile input, so it should never be the most privileged thing on the machine.
Run the scanner unprivileged. A crash there should stay a crash.
#linux#security#selfhosted#infosec#sysadmin
❯ Run the scanner unprivileged. A crash there should stay a crash.