Skip to main content

ClamAV CVE-2026-20217

| EUVDEUVD-2026-41082 HIGH
Classic Buffer Overflow (CWE-120)
2026-07-01 psirt@cisco.com GHSA-34f3-w8ff-r2xx
Buffer Overflow Secure Endpoint Clamav Red Hat Suse
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Untrusted files reach the scanner remotely without auth (AV:N/PR:N/UI:N/AC:L); confirmed impact is a scan-process crash only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 17:39 vuln.today

DescriptionCVE.org

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker crash the scanning engine by submitting a crafted PESpin-packed file for scanning. Because ClamAV frequently sits inline on mail gateways, file-upload paths, and proxies, a single malicious sample can terminate the scanning process and produce a denial of service; the memory corruption may permit expanded impact beyond DoS though only crash impact is confirmed. There is no public exploit identified at time of analysis and it is not on CISA KEV, with EPSS not provided.

Technical ContextAI

ClamAV is the widely used open-source antivirus engine (libclamav) that unpacks and inspects many executable and packer formats to detect malware. PESpin is a Windows PE executable packer/protector; ClamAV includes a dedicated unpacker that parses the PESpin structure to reach the underlying code for signature matching. The root cause is CWE-120 (buffer copy without checking the size of input / classic buffer overflow): during PESpin unpacking, ClamAV performs improper boundary checks on file-controlled content, allowing an out-of-bounds buffer write. Because the parser processes attacker-supplied byte structures without adequately validating sizes/offsets against buffer bounds, malformed PESpin content drives a write past the allocated buffer.

RemediationAI

Patch available per vendor advisory - upgrade ClamAV to the fixed release listed in Cisco advisory cisco-sa-clamav-88cFYyxR (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR); the exact patched version is not confirmed from the provided data and must be taken from the advisory. As a compensating control until patched, you can disable PE/packer unpacking so the vulnerable code path is not reached - set ScanPE no in clamd.conf (trade-off: reduces detection of packed PE malware, weakening protection); alternatively restrict which sources may submit files to the scanner (e.g., rate-limit or gate untrusted upload/attachment paths) and run clamd under a supervisor that auto-restarts on crash to limit DoS duration (trade-off: does not prevent the crash, only shortens outage). Ensure freshclam/engine updates are applied since fixes ship in engine releases, not signature databases.

More in Secure Endpoint

View all
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2026-20214 HIGH
7.5 Jul 01

Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning eng
CVE-2026-20213 HIGH
7.5 Jul 01

Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash
CVE-2026-20244 HIGH
7.5 Jul 01

Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning eng
CVE-2026-20243 HIGH
7.5 Jul 01

Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine
CVE-2026-20216 HIGH
7.5 Jul 01

Denial of service in ClamAV's InstallShield file format parser allows a remote, unauthenticated attacker (per CVSS PR:N)
CVE-2026-20215 HIGH
7.5 Jul 01

Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process
CVE-2023-20212 HIGH
7.5 Aug 18

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of serv
CVE-2023-20197 HIGH
7.5 Aug 16

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthe
CVE-2022-20785 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20771 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20770 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

Share

CVE-2026-20217 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy