Skip to main content

ClamAV CVE-2026-20338

| EUVDEUVD-2026-54529 HIGH
Double Free (CWE-415)
2026-08-07 cisco GHSA-xw98-8fcm-j8x7
Information Disclosure Cisco Suse Cisco Secure Endpoint
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Submitting a crafted zip to a network-accessible scanner requires no authentication; impact is a process crash affecting only availability, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 17:11 vuln.today
CVE Published
Aug 07, 2026 - 16:41 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

AnalysisAI

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.

Technical ContextAI

ClamAV is an open-source antivirus engine embedded within Cisco Secure Endpoint (formerly AMP for Endpoints), used to inspect files at rest and in transit across mail gateways, web proxies, and endpoint agents. The vulnerability resides in the zip archive content parser, where improper memory lifecycle management allows a heap allocation to be freed twice (CWE-415: Double Free). Double-free conditions corrupt the heap allocator's internal state, reliably causing process termination and, in some runtime environments, potentially enabling memory-reuse attacks - though the confirmed impact here is limited to a crash. The CPE string cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:* covers all versions of Cisco Secure Endpoint, indicating no version has been ruled out as unaffected.

RemediationAI

Apply the patched release of Cisco Secure Endpoint as specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26. No specific fixed version number was independently confirmed from the available data - consult the advisory directly for exact upgrade targets. As a compensating control pending patching, restrict which external sources or users can submit files to ClamAV-backed scanning interfaces, reducing the attacker-controlled file submission surface; note this may reduce scanning coverage for legitimate content. Implement process supervision or watchdog mechanisms for the ClamAV daemon to auto-restart after a crash, which does not prevent exploitation but reduces the duration of the availability gap. Monitor for unexpected ClamAV process terminations as an early detection indicator.

More in Cisco Secure Endpoint

View all
CVE-2026-20337 HIGH
7.5 Aug 07

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning proce
CVE-2026-20348 HIGH
7.5 Aug 07

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning proce
CVE-2026-20345 HIGH
7.5 Aug 07

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially co
CVE-2026-20339 HIGH
7.5 Aug 07

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attac
CVE-2026-20347 HIGH
7.5 Aug 07

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the sca
CVE-2026-20346 HIGH
7.5 Aug 07

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated re

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-20338 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy