diff --git a/package/clamav/0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch b/package/clamav/0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch
new file mode 100644
index 0000000000..a2ac405d92
--- /dev/null
+++ b/package/clamav/0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch
@@ -0,0 +1,46 @@
+From: "Val S." <valsnyde@cisco.com>
+Date: Tue, 16 Jun 2026 11:43:04 -0400
+Subject: Libclamav: fix PESpin cleanup bitmap tracking (#47)
+
+The PESpin unpacker mixes heap-owned section buffers with pointers
+back into the original PE image. Its final cleanup loop is supposed
+to walk a copy of the ownership bitmap and free only the entries
+that were allocated by the unpacker.
+
+That loop checked bitmap but shifted bitman instead. When the low
+bit was set, bitmap never changed and the loop could free every
+entry in sects, including pointers into the input buffer. A crafted
+sample can drive this path after an allocation failure and crash in
+free() with an invalid pointer.
+
+Shift bitmap in the cleanup loop so the free decision advances one
+section at a time using the same working bitmap that the condition
+already tests. This matches the existing intent of saving bitmap as
+a disposable free bitmap copy and avoids touching the original
+bitman state.
+
+Credit: Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab.
+
+CLAM-2961
+
+---
+Upstream: https://github.com/Cisco-Talos/clamav/commit/2410b002feb151500fa6cdee3233fe97c9fe865a
+CVE: CVE-2026-20217
+Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
+---
+ libclamav/spin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libclamav/spin.c b/libclamav/spin.c
+index a741fb83be..d0470b317a 100644
+--- a/libclamav/spin.c
++++ b/libclamav/spin.c
+@@ -508,7 +508,7 @@ int unspin(char *src, int ssize, struct cli_exe_section *sections, int sectcnt,
+     for (j = 0; j < sectcnt; j++) {
+         if (bitmap & 1)
+             free(sects[j]);
+-        bitman = bitman >> 1 & 0x7fffffff;
++        bitmap = bitmap >> 1 & 0x7fffffff;
+     }
+     free(sects);
+     return 1; /* :( */
diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk
index 56e4217f3f..d97390ca5e 100644
--- a/package/clamav/clamav.mk
+++ b/package/clamav/clamav.mk
@@ -27,6 +27,9 @@ CLAMAV_IGNORE_CVES += CVE-2016-1405
 # 0001-fix-possible-panic-when-scanning-some-html-files.patch
 CLAMAV_IGNORE_CVES += CVE-2026-20031
 
+# 0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch
+CLAMAV_IGNORE_CVES += CVE-2026-20217
+
 CLAMAV_DEPENDENCIES = \
 	bzip2 \
 	host-pkgconf \