ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a “heap out of bounds condition.”