Cisco has identified multiple critical vulnerabilities within ClamAV, an antivirus software widely used across various platforms, that may permit remote attackers to disrupt scanning operations and induce denial-of-service (DoS) conditions. These security issues pose significant risks, particularly to systems operating under Cisco’s Secure Endpoint Connector on Windows, Linux, and macOS.
Impact on Different Operating Systems
The vulnerabilities have been detailed in an advisory, cisco-sa-clamav-WuuvVd26, initially published on August 7, 2026, and subsequently updated on August 10. Cisco has rated the security impact as High for Windows systems and Medium for Linux and macOS. The disparity in ratings is attributed to the elevated privilege level at which ClamAV operates on Windows systems.
Details of the Vulnerabilities
The vulnerabilities, listed as CVE-2026-20337 through CVE-2026-20348, mostly carry a CVSS score of 7.5 and are exploitable remotely, without requiring authentication. These include issues like out-of-bounds writes, improper memory management, and insufficient boundary checks in various file parsers such as ZIP, PESpin, GPT, PDF, Mach-O, and XAR.
For instance, CVE-2026-20337 and CVE-2026-20338 affect the ZIP parser, potentially causing system crashes through out-of-bounds writes and double-free errors, respectively. CVE-2026-20339 involves the PESpin parser, risking integer overflow during scans. The remaining vulnerabilities impact other file parsers, each capable of triggering a DoS condition when scanning attacker-crafted files.
Recommendations and Security Measures
Cisco advises updating the Secure Endpoint Connector to the latest version through their portal as soon as the patches are available. Though Cisco Secure Endpoint Private Cloud itself isn’t directly affected, it requires updated connector software to ensure endpoint protection. Organizations are urged to check for updates in version 4.2.8 or later to receive necessary security enhancements.
While Cisco has noted the existence of public proof-of-concept exploit code for certain vulnerabilities, specifically CVE-2026-20337 and CVE-2026-20338, there have been no reports of these being used maliciously in real-world scenarios. Despite the lack of workarounds, immediate application of the provided fixes is crucial for safeguarding systems.
In light of these vulnerabilities, entities utilizing ClamAV should remain vigilant and proactive in applying security patches to mitigate potential threats and ensure the integrity of their antivirus defenses.
