Critical ClamAV Vulnerabilities Let Attackers Trigger DoS

Key Takeaways

• Cisco has revealed multiple high-severity vulnerabilities within ClamAV, its open-source antivirus engine.
• These flaws primarily affect Cisco Secure Endpoint Connector across Windows, Linux, and macOS platforms.
• Successful exploitation could lead to denial-of-service conditions, causing the ClamAV scanning process to crash and interrupt malware detection.
• Most vulnerabilities carry a CVSS score of 7.5 and can be exploited remotely without authentication.
• Patches are being rolled out, and organizations are urged to update their Cisco Secure Endpoint Connector installations immediately.

Cisco Discloses Critical ClamAV DoS Vulnerabilities

Cisco has issued an urgent advisory detailing several high-severity vulnerabilities present in ClamAV, its widely adopted open-source antivirus engine. These flaws could empower unauthenticated remote attackers to trigger denial-of-service (DoS) conditions, effectively disrupting antivirus scanning operations on affected systems.

The vulnerabilities specifically impact the ClamAV parsers utilized by the Cisco Secure Endpoint Connector on Windows, Linux, and macOS operating systems. Cisco’s advisory, identified as cisco-sa-clamav-WuuvVd26, was initially published on August 7, 2026, and subsequently updated on August 10.

Cisco has assigned a “High” security impact rating for Windows systems affected by these vulnerabilities, while Linux and macOS environments received a “Medium” rating. This distinction, according to Cisco, stems from the elevated privilege context under which the ClamAV scanning process operates on Windows devices.

Multiple Flaws Threaten Antivirus Integrity

The reported vulnerabilities encompass CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, and CVE-2026-20348. The majority of these carry a CVSS score of 7.5, highlighting their significant severity, and can be exploited remotely without requiring authentication or user interaction.

A successful exploit of any of these vulnerabilities could result in the abrupt termination of the ClamAV scanning process. Such an interruption would prevent the detection of malware and ultimately lead to a denial-of-service state for the antivirus service.

Technical Breakdown of Key Vulnerabilities

CVE-2026-20337 is an out-of-bounds write vulnerability found within ClamAV’s ZIP archive parser. An attacker could craft a malicious ZIP file and send it to a vulnerable system for scanning. Insufficient boundary validation during the parsing process could then cause the scanner to crash.

Similarly, CVE-2026-20338 also targets ZIP file processing but arises from improper memory handling. A specially designed archive could trigger a double-free condition, leading to the termination of the scanning engine.

Another critical flaw, CVE-2026-20339, affects the PESpin file format parser. This vulnerability stems from inadequate boundary checks, which could result in an integer overflow during file scanning. Cisco warned that this particular issue could not only facilitate a denial-of-service attack but also potentially lead to broader consequences due to memory corruption.

Additional vulnerabilities identified include:

• CVE-2026-20345: A memory corruption flaw in the GPT parser due to improper endian conversion, potentially leading to an out-of-bounds buffer write.
• CVE-2026-20346: An out-of-bounds read vulnerability in the PDF parser.
• CVE-2026-20347: An out-of-bounds read vulnerability affecting the Mach-O parser.
• CVE-2026-20348: A boundary flaw within the XAR parser.

All these vulnerabilities can be triggered when ClamAV attempts to scan attacker-controlled files. This implies that common vectors such as malicious email attachments, downloaded archives, shared documents, or files uploaded through web applications could serve as potential delivery mechanisms, depending on the specific deployment of ClamAV.

Cisco clarified that these vulnerabilities are independent, meaning exploiting one does not necessitate exploiting another. The Cisco Secure Endpoint Connector for Windows is highlighted as the most significantly impacted product due to its privileged scanning context.

While Secure Endpoint Connector for Linux and Mac are also affected, their lower-privileged scanning processes mitigate the overall security impact. Cisco Secure Endpoint Private Cloud deployments are not directly vulnerable, but organizations must ensure they distribute updated connector software to their protected endpoints. Cisco has confirmed that no workarounds are available for these issues.

Cisco PSIRT is aware of public proof-of-concept exploit code for CVE-2026-20337 and CVE-2026-20338 but states that no malicious exploitation of any of these vulnerabilities has been observed in the wild.

What You Should Do

• Apply Patches Immediately: Customers should apply the fixed Cisco Secure Endpoint Connector releases as soon as they become available through the Secure Endpoint portal.
• Private Cloud Updates: Organizations using Cisco Secure Endpoint Private Cloud must ensure they are running version 4.2.8 or later to receive updated connector software via standard content update processes.
• Monitor Deployments: Regularly monitor your ClamAV deployments for any unusual activity or service interruptions that could indicate an attempted exploitation.
• Review Security Best Practices: Reiterate security best practices for handling email attachments and downloaded files, as these are common vectors for delivering malicious content designed to trigger such vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.