Skip to main content

ClamAV CVE-2026-20216

| EUVDEUVD-2026-41081 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-01 psirt@cisco.com GHSA-8fx8-2p33-gv76
Denial Of Service Secure Endpoint Clamav Red Hat Suse
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Attacker-supplied file reaches the scanner remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is temporary scanner DoS only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 17:38 vuln.today

DescriptionCVE.org

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

AnalysisAI

Denial of service in ClamAV's InstallShield file format parser allows a remote, unauthenticated attacker (per CVSS PR:N) to crash the scanning engine and temporarily exhaust system resources by submitting a specially crafted InstallShield file for scanning. The flaw stems from improper handling of temporary resources during file scanning (CWE-770), impacting availability only (C:N/I:N/A:H) with no code execution or data exposure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious InstallShield file
Delivery
Deliver via email or upload for scanning
Exploit
ClamAV InstallShield parser mishandles temp resources
Execution
Scanning process terminates and consumes resources
Impact
Denial of service on ClamAV engine
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must be able to get a crafted InstallShield-format file scanned by the target ClamAV instance - i.e., the deployment must scan attacker-influenced files (mail gateway, upload scanner, file-share AV) and must have the InstallShield file parser enabled (it is enabled by default in standard scanning). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - network reachable, low complexity, no privileges or user interaction, and a pure availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker emails a crafted InstallShield installer file (or uploads it to a service) that is automatically routed to a ClamAV-backed scanner. When ClamAV parses the file, its InstallShield handler mishandles temporary resources, terminating the scanning process and temporarily spiking system resource usage, so legitimate messages or uploads queue up or fail to be scanned. …
Remediation Patch available per vendor advisory - upgrade to the fixed ClamAV release identified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR; the input data does not contain an exact fix version, so obtain the precise patched build from that advisory and do not rely on an assumed version number. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all ClamAV deployments, document versions and network exposure, enable service-crash monitoring with alerts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Secure Endpoint

View all
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2026-20214 HIGH
7.5 Jul 01

Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning eng
CVE-2026-20213 HIGH
7.5 Jul 01

Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash
CVE-2026-20244 HIGH
7.5 Jul 01

Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning eng
CVE-2026-20243 HIGH
7.5 Jul 01

Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine
CVE-2026-20217 HIGH
7.5 Jul 01

Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker
CVE-2026-20215 HIGH
7.5 Jul 01

Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process
CVE-2023-20212 HIGH
7.5 Aug 18

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of serv
CVE-2023-20197 HIGH
7.5 Aug 16

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthe
CVE-2022-20785 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20771 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20770 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-20216 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy