CVE-2020-26893

Name of the Vulnerable Software and Affected Versions ClamXAV versions prior to 3.1.1

Description An issue was discovered in ClamXAV where a malicious actor could use a properly signed copy of ClamXAV 2, running with an injected malicious dylib, to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client verification in the helper tool.

Recommendations For ClamXAV versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the helper tool to minimize the risk of exploitation.