ClamAV CVE-2026-20337

ClamAV is Cisco's embedded open-source antivirus scanning engine used within Cisco Secure Endpoint (CPE: cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:*) for file scanning and threat detection. The vulnerable component is the zip archive parser, which processes the internal structure of .zip files during content scanning. CWE-120 (Classic Buffer Overflow - Buffer Copy without Checking Size of Input) identifies the root cause: when parsing zip content, the parser does not enforce proper boundary checks, allowing crafted input to write beyond an allocated buffer. An out-of-bounds write in a parsing context typically overwrites adjacent memory, leading to process termination if the corruption corrupts critical runtime state such as heap metadata or control structures. Because the scan engine receives externally-supplied files as its primary input surface, this class of vulnerability is inherently exploitable over the network without any authentication.