GitHub Exploit Metadata - Exploit Intel

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Technical assessment

A Python 3 exploit for CVE-2026-20348 that crafts a malicious XAR file to trigger an out-of-bounds memory allocation in ClamAV's XAR parser, causing a denial-of-service via OOM kill. The script generates the payload, stages it in a Docker container, executes clamscan, and verifies the process was killed by SIGKILL.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2026-20348 consists of a Python script that generates a crafted XAR file and uses Docker to trigger a memory-exhaustion DoS in a vulnerable ClamAV container. The script performs only the described exploit behavior: it builds a XAR with a large declared TOC, stages it into a container, runs clamscan, and checks for an OOM-kill signal. No backdoor, concealed payload, or operator-directed harm is present.

ClassificationExploit

Model confidence98%

AuthenticationNot required

Languagespython

Target softwareClamAV

Attack typesdenial-of-service

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because it contains code (poc/poc.py) that actively crafts a malicious input and executes it against a target to trigger a vulnerability, resulting in a denial-of-service condition. The README and verification report confirm its purpose is to exercise the vulnerability, not just detect it.

README.md:1poc/poc.py:1-3poc_verification_report.md:1

Requirements

A running Docker container of a vulnerable ClamAV version (<= 1.5.3) with a memory cap.poc/poc.py:99-105

Observed behavior

Crafts a XAR file with a header declaring a decompressed TOC size just under 1 GiB and a compressed TOC of ~1 MB.poc/poc.py:68-84
Stages the crafted XAR file and a minimal signature database into the target Docker container.poc/poc.py:122-129
Executes clamscan on the crafted file inside the container and checks for exit code 137 (SIGKILL) and the container's OOMKilled flag to confirm successful exploitation.poc/poc.py:134-158

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Docker Exec: docker exec cid clamscan ...The PoC uses docker exec to run clamscan inside a lab container, which is the expected delivery mechanism for the DoS trigger.poc/poc.py:135-136
File Write: build_xar writes oom-toc.xarThe script writes a crafted XAR file to a temporary directory; this is the exploit payload generation, not a backdoor.poc/poc.py:68-84

Review boundaries

What the analysis did not establish

Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 3 unclassified binary files totaling 7772 bytes were not analyzed.
The analysis is based solely on static review of the provided source code and documentation; the code was not executed.
Binary files (e.g., the crafted XAR) are not inspected; the review covers only the provided readable text.
The analysis does not verify the correctness or safety of the exploit against the target; it only assesses the PoC for backdoor behavior.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-20348/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-20348Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-10

Environment assessment

A containerized lab for demonstrating CVE-2026-20348, a memory-exhaustion DoS in ClamAV's XAR parser. It uses two stock ClamAV images (vulnerable 1.5.3 and fixed 1.5.4) with a Python PoC that triggers an OOM kill on the vulnerable build.

CVE-2026-20348/README.md:1-106CVE-2026-20348/docker-compose.yml:1-24

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-20348), provides a PoC, and sets up vulnerable and control environments for reproduction. The compose file defines two services with profiles for vulnerable and control testing.

CVE-2026-20348/README.md:1-106CVE-2026-20348/docker-compose.yml:1-24

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

target

vulnerable ClamAV scanner

Service using clamav/clamav:1.5.3, the vulnerable version. It runs sleep infinity to keep the container alive for manual clamscan execution. A healthcheck verifies clamscan is available.

CVE-2026-20348/docker-compose.yml:2-12

control

patched ClamAV scanner

Service using clamav/clamav:1.5.4, the fixed version. It also runs sleep infinity and has a similar healthcheck. Used to confirm the PoC does not trigger the vulnerability on the patched build.

CVE-2026-20348/docker-compose.yml:14-24

poc.py

proof-of-concept exploit

Python script that generates a crafted XAR file, stages it into the target container, and runs clamscan with a 100 MiB scan-size limit. It determines success by checking for exit code 137 (SIGKILL) and the container's OOMKilled flag.

CVE-2026-20348/poc/poc.py:1-162

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-20348

Supported by supplied evidence

The lab explicitly targets CVE-2026-20348. The README, PoC script, and verification report all describe the vulnerability, its impact (OOM kill), and the fix. The compose file provides the exact vulnerable and fixed versions.

CVE-2026-20348/README.md:1-106CVE-2026-20348/poc/poc.py:1-162CVE-2026-20348/poc_verification_report.md:1-49

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to run the lab containers.CVE-2026-20348/README.md:72-82
Python 3 with standard library is required to execute the PoC script.CVE-2026-20348/README.md:84
The vulnerable target container must be started with the 'vulnerable' profile before running the PoC.CVE-2026-20348/README.md:75

Evidence-described exercise path

Start the vulnerable target container using 'docker compose -p cve-2026-20348-pub-vuln --profile vulnerable up -d'.CVE-2026-20348/README.md:75
Run the PoC against the vulnerable container: 'python3 poc/poc.py cve-2026-20348-pub-vuln'. The script generates a crafted XAR, copies it into the container, and executes clamscan. Expected result: [SUCCESS] with exit code 137.CVE-2026-20348/README.md:78CVE-2026-20348/poc/poc.py:1-162
Start the control (patched) container using 'docker compose -p cve-2026-20348-pub-control --profile control up -d'.CVE-2026-20348/README.md:76
Run the same PoC against the control container: 'python3 poc/poc.py cve-2026-20348-pub-control'. Expected result: [FAILED] with exit code 0 or 2.CVE-2026-20348/README.md:81
Tear down the environments with 'docker compose -p <project> down -v'.CVE-2026-20348/README.md:83-84

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The PoC targets only the lab's own ClamAV container, causing an expected OOM kill within that container to demonstrate the vulnerability. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended DoS on the vulnerable service.

CVE-2026-20348/poc/poc.py:1-162CVE-2026-20348/README.md:1-106

Review boundaries

What the analysis did not establish

The packet does not include the files intel_brief.md and vulnerability_analysis.md referenced in the README, but their absence does not affect the analysis of the provided evidence.
The PoC script uses docker exec and docker cp, which require access to the Docker socket; this is a typical lab requirement but could be a concern if the lab were run in a shared environment without isolation.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.