Multiple ClamAV Vulnerabilities Threaten Antivirus Scanning with Denial-of-Service
Cisco has disclosed a series of high-severity vulnerabilities in ClamAV parsers that could allow unauthenticated remote attackers to cause denial-of-service conditions by submitting crafted files for scanning.
Cisco has revealed multiple high-severity vulnerabilities affecting the ClamAV parsers, a component widely used in antivirus solutions, including Cisco Secure Endpoint Connector. These flaws, detailed in a Cisco advisory first published on August 7, 2026, and updated on August 10, could permit unauthenticated remote attackers to disrupt antivirus scanning operations, leading to denial-of-service (DoS) conditions. The vulnerabilities span several ClamAV parsers and have been assigned CVE identifiers from CVE-2026-20337 to CVE-2026-20348. Cisco has rated the security impact as High for affected Windows systems, while Linux and macOS environments are rated Medium, primarily due to the more privileged security context under which the ClamAV scanner operates on Windows.
The identified vulnerabilities include issues such as out-of-bounds writes, double-free conditions, and integer overflows. For instance, CVE-2026-20337, an out-of-bounds write in the ZIP archive parser, can be triggered by a specially crafted ZIP file, causing the scanner process to crash due to improper boundary validation. Similarly, CVE-2026-20338, also affecting ZIP file processing, stems from improper memory handling that can lead to a double-free condition, terminating the scanning engine. Another critical flaw, CVE-2026-20339, resides in the PESpin file format parser and results from insufficient boundary checks, potentially leading to an integer overflow and memory corruption during file scanning.
Beyond ZIP and PESpin files, other affected parsers include those for GPT, PDF, Mach-O, and XAR file formats. CVE-2026-20345 involves an improper endian conversion in the GPT parser, leading to an out-of-bounds buffer write. CVE-2026-20346 and CVE-2026-20347 affect PDF and Mach-O file parsing, respectively, enabling out-of-bounds buffer reads. Lastly, CVE-2026-20348 is a boundary flaw in the XAR archive handler. All these vulnerabilities can be exploited when ClamAV scans attacker-controlled files, making common delivery vectors such as email attachments, downloaded archives, shared documents, and files submitted via web applications a significant concern.
Cisco emphasizes that these vulnerabilities are independent, meaning an attacker does not need to chain them to achieve a malicious outcome. The most significant impact is observed on Cisco Secure Endpoint Connector for Windows due to the scanner's privileged execution context. While Secure Endpoint Connector for Linux and Mac are also vulnerable, the lower-privileged scanning process mitigates the severity. Cisco Secure Endpoint Private Cloud is not directly vulnerable, but organizations using it must ensure updated connector software is distributed to protected endpoints.
Currently, Cisco states that no workarounds are available for these vulnerabilities. Customers are strongly advised to apply the fixed Cisco Secure Endpoint Connector releases as soon as they become available through the Secure Endpoint portal. For Private Cloud customers, ensuring they are running version 4.2.8 or later is crucial for receiving updated connector software via normal content update processes.
Cisco's Product Security Incident Response Team (PSIRT) has acknowledged the existence of public proof-of-concept exploit code for CVE-2026-20337 and CVE-2026-20338. Despite this, the company has not yet observed any malicious exploitation of these vulnerabilities in the wild. However, the availability of exploit code significantly increases the risk of future attacks, making timely patching and vigilance essential for organizations relying on ClamAV for their security.
The disclosure of these multiple vulnerabilities in ClamAV highlights the ongoing challenges in securing widely used open-source components. Antivirus engines, by their nature, must process a vast array of file types and formats, creating a large attack surface. Flaws in these parsing mechanisms can have far-reaching consequences, potentially disabling the very security tools designed to protect systems. This incident underscores the importance of continuous security auditing and rapid patching for critical infrastructure software.