Multiple high-severity vulnerabilities have been identified in ClamAV, the open-source antivirus engine, potentially allowing unauthenticated remote attackers to disrupt scanning operations and trigger denial-of-service (DoS) conditions. These flaws impact ClamAV parsers utilized by Cisco Secure Endpoint Connector across Windows, Linux, and macOS platforms.
Details of the Vulnerabilities
The vulnerabilities, cataloged as CVE-2026-20337 through CVE-2026-20348, predominantly carry a CVSS score of 7.5. Exploitation does not require authentication or user interaction, making them particularly concerning. Successful attacks could terminate the ClamAV scanning process, thereby interrupting malware detection capabilities and leading to DoS scenarios.
Specific vulnerabilities include:
- CVE-2026-20337: An out-of-bounds write in the ZIP archive parser, where a specially crafted ZIP file can cause the scanner to crash due to improper boundary validation.
- CVE-2026-20338: A double-free condition in ZIP file processing, leading to termination of the scanning engine when handling malicious archives.
- CVE-2026-20339: An integer overflow in the PESpin file format parser resulting from insufficient boundary checks, potentially causing memory corruption.
- CVE-2026-20345: Memory corruption in the GPT parser due to improper endian conversion, leading to out-of-bounds buffer writes.
- CVE-2026-20346: An out-of-bounds read in the PDF parser, which can cause the scanner to crash when processing certain files.
- CVE-2026-20347: Similar out-of-bounds read issues in the Mach-O parser, leading to potential crashes.
- CVE-2026-20348: Boundary flaws in the XAR parser, resulting in crashes during the scanning process.
These vulnerabilities can be exploited by submitting specially crafted files for scanning, making email attachments, downloaded archives, shared documents, and files uploaded via web applications potential vectors, depending on ClamAV’s deployment.
Impact and Mitigation
Cisco has assigned a High security impact rating to affected Windows systems, attributed to the privileged security context of the ClamAV scanning process on these devices. Linux and macOS environments received a Medium rating due to their lower-privileged scanning processes.
Currently, no workarounds are available. Organizations are advised to apply the fixed Cisco Secure Endpoint Connector releases through the Secure Endpoint portal as they become available. Private Cloud customers should ensure they are running version 4.2.8 or later to receive updated connector software through standard content update processes.
While public proof-of-concept exploit code exists for CVE-2026-20337 and CVE-2026-20338, there have been no observed instances of malicious exploitation in the wild.
These vulnerabilities underscore the critical importance of timely software updates and vigilant monitoring of security advisories. Organizations relying on ClamAV should prioritize patching to maintain robust malware detection capabilities and prevent potential service disruptions.
