Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs
Cisco warns of seven ClamAV denial-of-service flaws in Secure Endpoint Connector, two with public PoCs; patches due in August.
Cisco warned that seven ClamAV denial-of-service vulnerabilities, tracked as CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 through CVE-2026-20348, affect the Secure Endpoint Connector on Windows, macOS and Linux. Two flaws, CVE-2026-20337 (CVSS 7.5, out-of-bounds write) and CVE-2026-20338 (memory double-free), have public proof-of-concept code, but Cisco PSIRT reports no evidence of malicious exploitation. Fixes shipped in ClamAV 1.5.4, with Cisco patches due in August and no workaround available. Windows is rated high risk because ClamAV runs with elevated privileges there.
- Seven parser flaws allow unauthenticated remote attackers to crash ClamAV scanning via crafted files.
- Public PoC exploit code exists for CVE-2026-20337 and CVE-2026-20338.
- Affected: Secure Endpoint Connector for Windows (High), macOS and Linux (Medium); Private Cloud unaffected but distributes fixes.
- Fixes available in ClamAV 1.5.4; Cisco endpoint patches scheduled for August 2026 with no workaround.
- CVEs
- CVE-2026-20337CVE-2026-20338CVE-2026-20339CVE-2026-20345CVE-2026-20346CVE-2026-20347CVE-2026-20348
- Vendors
- Cisco
- Organizations
- Cisco PSIRT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-20337+1 related CVE | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device | 7.5 | <1% | ||
| CVE-2026-20339 | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… | 7.5 | <1% | ||
| CVE-2026-20345 | A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… | 7.5 | <1% | ||
| CVE-2026-20346 | A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… | 7.5 | <1% | ||
| CVE-2026-20347 | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… | 7.5 | <1% | ||
| CVE-2026-20348 | A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded… | 7.5 | <1% |
From the original article
2 min read at securityaffairs.comCisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks. Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.