Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs
Cisco warns of seven ClamAV denial-of-service flaws in Secure Endpoint Connector, two with public PoCs; patches due in August.
Cisco warned that seven ClamAV denial-of-service vulnerabilities, tracked as CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 through CVE-2026-20348, affect the Secure Endpoint Connector on Windows, macOS and Linux. Two flaws, CVE-2026-20337 (CVSS 7.5, out-of-bounds write) and CVE-2026-20338 (memory double-free), have public proof-of-concept code, but Cisco PSIRT reports no evidence of malicious exploitation. Fixes shipped in ClamAV 1.5.4, with Cisco patches due in August and no workaround available. Windows is rated high risk because ClamAV runs with elevated privileges there.
45