Skip to main content

ClamAV CVE-2026-20214

| EUVDEUVD-2026-41079 HIGH
Classic Buffer Overflow (CWE-120)
2026-07-01 psirt@cisco.com GHSA-86w7-h9x4-hpxv
Buffer Overflow Cisco Red Hat Secure Endpoint Suse
7.5
CVSS 3.1 · Vendor: cisco
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft FSG-packed PE file
  2. Delivery
    Submit file to scanning service
  3. Exploit
    Trigger out-of-bounds write in FSG parser
  4. Execution
    Corrupt scanner process memory
  5. Impact
    Crash ClamAV scanning engine (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-120
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that ClamAV actually scan an attacker-supplied file and that its FSG/PE unpacking path be exercised - i.e., the target must ingest untrusted files (mail attachment scanning, file-upload scanning, proxy/ICAP inspection) and have PE unpacking enabled (ScanPE, on by default). The trigger is specifically a file containing portable-executable content compressed with FSG; ordinary files do not reach the vulnerable code. Consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed once such a file is submitted for scanning. The main limiting factor is deployment context: hosts that only scan trusted/internal content, or that have PE scanning disabled, are not realistically exposed, and confirmed impact is a scanner crash rather than proven code execution.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates a network-reachable, low-complexity, unauthenticated, no-interaction flaw whose confirmed impact is availability-only - a scanner crash/DoS. The description hedges with 'possibly other expanded impacts,' but the official CVSS explicitly scores C:N/I:N, so code execution is speculative and NOT reflected in the base metrics; defenders should treat confirmed impact as DoS and any RCE as unproven. EPSS is not provided in the input and cannot be cited. There is no KEV listing and no POC referenced, so this is not confirmed as actively exploited - the risk is driven by exposure rather than observed attacks. Real-world priority is elevated for organizations that run ClamAV inline on untrusted input (mail gateways, upload scanners, ICAP proxies), where an attacker can repeatedly crash scanning and potentially create a security-control gap; it is lower for hosts that only scan trusted local files. Note the memory-corruption primitive (out-of-bounds write) leaves open the theoretical door to more than DoS, which is why patching should not be deferred solely because current scoring is availability-only.
Exploit ScenarioDerived

An attacker emails or uploads a small crafted PE that is compressed with FSG so that its embedded content violates the parser's boundary assumptions; when the mail gateway or upload handler passes the file to ClamAV, the FSG unpacker writes out of bounds and the scanning process terminates. Repeating this creates a sustained denial of service for the scanning tier, and because the primitive is a memory write, more severe impact cannot be fully excluded. No public POC is referenced in the input.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 01, 2026

Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning engine, and potentially achieve broader memory-corruption impact, by submitting a crafted FSG-compressed portable executable to be scanned. The flaw stems from an out-of-bounds buffer write during FSG decompression, affecting any deployment that scans attacker-supplied files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network-reachable, no-authentication, no-interaction nature (CVSS 7.5) makes it a meaningful availability risk for mail/file-scanning gateways.

RemediationAI

Upgrade ClamAV to the fixed release identified in the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR); the exact patched version is not included in the provided input and must be read from that advisory rather than invented. As a compensating control until patched, you can disable scanning of the affected packer path - set 'ScanPE no' in clamd.conf to turn off portable-executable unpacking (side effect: reduced detection of packed PE malware, a real security trade-off), and consider limiting or rejecting inbound file types that reach the scanner. Where ClamAV is embedded in a third-party appliance, apply the vendor's downstream update. After patching, restart clamd and any daemons that link libclamav so the fixed parser is loaded.

Affected VersionsENISA

Cisco Secure Endpoint 7.3.9
Cisco Secure Endpoint 1.25.2
Cisco Secure Endpoint 1.23.0
Cisco Secure Endpoint 1.20.2
Cisco Secure Endpoint 6.0.9
Cisco Secure Endpoint 1.23.1
Cisco Secure Endpoint 1.27.2
Cisco Secure Endpoint 1.15.0
Cisco Secure Endpoint 7.4.1
Cisco Secure Endpoint 8.1.3
Cisco Secure Endpoint 1.11.1
Cisco Secure Endpoint 1.24.5
Cisco Secure Endpoint 7.2.13
Cisco Secure Endpoint 7.4.3
Cisco Secure Endpoint 7.5.5
Cisco Secure Endpoint 7.5.11
Cisco Secure Endpoint 1.20.3
Cisco Secure Endpoint 1.12.0
Cisco Secure Endpoint 7.2.3
Cisco Secure Endpoint 7.5.7
Cisco Secure Endpoint 1.12.3
Cisco Secure Endpoint 1.12.5
Cisco Secure Endpoint 1.20.4
Cisco Secure Endpoint 1.13.1
Cisco Secure Endpoint 8.4.1.30307
Cisco Secure Endpoint 1.27.1
Cisco Secure Endpoint 1.20.0
Cisco Secure Endpoint 1.22.4
Cisco Secure Endpoint 1.8.0
Cisco Secure Endpoint 7.3.5
Cisco Secure Endpoint 8.1.5.21322
Cisco Secure Endpoint 1.21.1
Cisco Secure Endpoint 1.20.6
Cisco Secure Endpoint 1.15.5
Cisco Secure Endpoint 7.3.1
Cisco Secure Endpoint 8.1.7
Cisco Secure Endpoint 1.26.1
Cisco Secure Endpoint 8.1.3.21242
Cisco Secure Endpoint 8.1.7.21585
Cisco Secure Endpoint 1.17.1
Cisco Secure Endpoint 1.20.1
Cisco Secure Endpoint 1.15.2
Cisco Secure Endpoint 1.20.7
Cisco Secure Endpoint 1.20.5
Cisco Secure Endpoint 7.3.15
Cisco Secure Endpoint 1.25.0
Cisco Secure Endpoint 1.20.8
Cisco Secure Endpoint 8.0.1.21164
Cisco Secure Endpoint 6.1.9
Cisco Secure Endpoint 1.15.6
Cisco Secure Endpoint 8.2.3.30119
Cisco Secure Endpoint 6.1.7
Cisco Secure Endpoint 1.24.4
Cisco Secure Endpoint 7.5.15.21611
Cisco Secure Endpoint 1.9.1
Cisco Secure Endpoint 1.25.1
Cisco Secure Endpoint 1.12.4
Cisco Secure Endpoint 1.14.0
Cisco Secure Endpoint 7.1.5
Cisco Secure Endpoint 1.16.2
Cisco Secure Endpoint 8.1.7.21512
Cisco Secure Endpoint 8.4.2.30317
Cisco Secure Endpoint 1.14.1
Cisco Secure Endpoint 1.17.0
Cisco Secure Endpoint 1.12.7
Cisco Secure Endpoint 8.4.4.30467
Cisco Secure Endpoint 1.16.1
Cisco Secure Endpoint 8.1.7.21417
Cisco Secure Endpoint 6.3.1
Cisco Secure Endpoint 7.5.9
Cisco Secure Endpoint 1.17.2
Cisco Secure Endpoint 8.4.4.30419
Cisco Secure Endpoint 7.5.19
Cisco Secure Endpoint 1.24.2
Cisco Secure Endpoint 7.4.1.20425
Cisco Secure Endpoint 1.21.3
Cisco Secure Endpoint 7.3.13
Cisco Secure Endpoint 6.3.7
Cisco Secure Endpoint 1.21.2
Cisco Secure Endpoint 1.8.1
Cisco Secure Endpoint 1.18.0
Cisco Secure Endpoint 6.2.5
Cisco Secure Endpoint 8.0.1.21160
Cisco Secure Endpoint 7.5.20
Cisco Secure Endpoint 1.15.3
Cisco Secure Endpoint 6.3.3
Cisco Secure Endpoint 8.2.1.21650
Cisco Secure Endpoint 1.24.1
Cisco Secure Endpoint 1.22.2
Cisco Secure Endpoint 8.2.4.30130
Cisco Secure Endpoint 8.4.0
Cisco Secure Endpoint 6.2.3
Cisco Secure Endpoint 7.5.3
Cisco Secure Endpoint 6.3.5
Cisco Secure Endpoint 1.24.3
Cisco Secure Endpoint 1.8.4
Cisco Secure Endpoint 6.2.1
Cisco Secure Endpoint 1.27.0
Cisco Secure Endpoint 1.9.0
Cisco Secure Endpoint 1.15.4
Cisco Secure Endpoint 1.22.3
Cisco Secure Endpoint 1.26.0
Cisco Secure Endpoint 6.2.9
Cisco Secure Endpoint 8.2.1.21612
Cisco Secure Endpoint 8.4.5.30483
Cisco Secure Endpoint 1.10.1
Cisco Secure Endpoint 1.24.0
Cisco Secure Endpoint 7.2.7
Cisco Secure Endpoint 1.12.2
Cisco Secure Endpoint 1.22.0
Cisco Secure Endpoint 6.2.19
Cisco Secure Endpoint 1.13.0
Cisco Secure Endpoint 7.4.1.20439
Cisco Secure Endpoint 8.4.1.30298
Cisco Secure Endpoint 1.11.0
Cisco Secure Endpoint 7.2.11
Cisco Secure Endpoint 7.4.3.20679
Cisco Secure Endpoint 8.1.5
Cisco Secure Endpoint 1.10.0
Cisco Secure Endpoint 7.4.5
Cisco Secure Endpoint 1.10.2
Cisco Secure Endpoint 7.5.17.21680
Cisco Secure Endpoint 7.1.1
Cisco Secure Endpoint 1.21.0
Cisco Secure Endpoint 7.2.5
Cisco Secure Endpoint 7.3.3
Cisco Secure Endpoint 1.15.1
Cisco Secure Endpoint 7.5.21.21732
Cisco Secure Endpoint 7.5.1.20833
Cisco Secure Endpoint 1.7.0
Cisco Secure Endpoint 1.6.0
Cisco Secure Endpoint 1.12.6
Cisco Secure Endpoint 1.22.1
Cisco Secure Endpoint 6.0.7
Cisco Secure Endpoint 1.19.0
Cisco Secure Endpoint 7.5.13.21586
Cisco Secure Endpoint 1.13.2
Cisco Secure Endpoint 7.5.13.21598
Cisco Secure Endpoint 6.1.5
Cisco Secure Endpoint 1.16.0
Cisco Secure Endpoint 1.16.3
Cisco Secure Endpoint 7.5.1.20813
Cisco Secure Endpoint 1.12.1
Cisco Secure Endpoint 8.4.3
Cisco Secure Endpoint 7.0.5
Cisco Secure Endpoint 1.18.1

Affected Packages

euvd cisco_secure_endpoint no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ClamAV is a widely used open-source antivirus engine that unpacks and inspects many executable and archive formats to detect malware, including files compressed with FSG (a compressor/packer historically used to shrink Windows PE executables). To scan a packed PE, ClamAV must decompress the FSG container in memory before signature matching. The vulnerability is a classic CWE-120 (Buffer Copy without Checking Size of Input, 'Classic Buffer Overflow'): the FSG parser performs improper boundary checks on the embedded content, so specially sized/crafted FSG data drives an out-of-bounds write beyond an allocated buffer. Because scanning is fully automated and triggered simply by presenting a file, the vulnerable code path is reached without any user action. The vulnerability was reported by Cisco PSIRT, consistent with Cisco's stewardship of ClamAV.

Know when Secure Endpoint gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (cisco) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

File reaches the scanner over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); confirmed impact is scanner crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in ClamAV's file parser allows unauthenticated attackers to crash the scanning service by submitting a specially crafted file. Although no public exploit has been identified at time of analysis, the lack of authentication requirements and network accessibility means any file-submission endpoint is a potential attack vector. This vulnerability directly threatens email availability and business continuity for organizations using ClamAV.

Business Impact: High
Compensating Controls

Implement perimeter filtering to block FSG-compressed files; segment ClamAV scanners from direct internet exposure; deploy scanner redundancy to mitigate availability impact of individual instance crashes; enable vendor security notifications; consider temporary disabling of FSG format scanning if risk cannot be otherwise mitigated pending patch availability.

Threat Intelligence Overview

EPSS Score
0.5%
Top 63% exploitable
Prevalence
High
widely deployed open-source AV engine in mail and file gateways
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Secure Endpoint

View all
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2026-20213 HIGH
7.5 Jul 01

Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash
CVE-2026-20244 HIGH
7.5 Jul 01

Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning eng
CVE-2026-20243 HIGH
7.5 Jul 01

Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine
CVE-2026-20217 HIGH
7.5 Jul 01

Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker
CVE-2026-20216 HIGH
7.5 Jul 01

Denial of service in ClamAV's InstallShield file format parser allows a remote, unauthenticated attacker (per CVSS PR:N)
CVE-2026-20215 HIGH
7.5 Jul 01

Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process
CVE-2023-20212 HIGH
7.5 Aug 18

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of serv
CVE-2023-20197 HIGH
7.5 Aug 16

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthe
CVE-2022-20785 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20771 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20770 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20214 ADVISORY https://ubuntu.com/security/notices/USN-8517-1 ADVISORY https://vuldb.com/vuln/375634 REF https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy