Vulnerability · Published Oct 5, 2026 · Assigned by cisa-cg
CVE-2026-105773Canimaan Software ClamXAV local privilege escalation
High 7.0
In plain English
A high-severity race condition in ClamXAV from Canimaan Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canimaan Software | ClamXAV | 3.3 – before 3.11.1 |
Weakness: CWE-362 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H