Skip to main content

ClamAV CVE-2026-20339

| EUVDEUVD-2026-54506 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-08-07 cisco GHSA-g59m-qx73-q3c6
Buffer Overflow Integer Overflow Cisco Suse Cisco Secure Endpoint
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

File submission to a network-accessible scanner requires no authentication or privileges; impact is availability-only based on confirmed DoS outcome.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 17:10 vuln.today
CVE Published
Aug 07, 2026 - 16:42 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.

Technical ContextAI

ClamAV is the open-source antivirus engine embedded in Cisco Secure Endpoint (CPE: cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:*). PESpin is a Windows PE packer and protector; ClamAV includes a dedicated file format parser to unpack and inspect PESpin-protected executables during scanning. CWE-190 (Integer Overflow or Wraparound) describes the root cause: the parser performs arithmetic on values from the PESpin file without adequate bounds validation, allowing attacker-controlled input to cause an integer to wrap around, producing an unexpectedly small or negative value that drives subsequent memory operations out of bounds. This class of bug in a parser executed on untrusted input is a well-understood attack surface in antivirus engines, where complex format parsers are exposed to hostile content by design. The version field in the CPE string is a wildcard, meaning no specific affected version range has been disclosed in NVD CPE data alone; the Cisco advisory must be consulted for version scope.

RemediationAI

The primary fix is to apply the patched version of Cisco Secure Endpoint as detailed in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26. An exact patched release version is not specified in the available reference data; consult the advisory directly for the minimum fixed version applicable to your platform and channel. Patch availability is confirmed per vendor advisory, but the specific version number is not independently verifiable from current data. As a compensating control where immediate patching is not possible, consider restricting the types of files submitted to ClamAV scanning by blocking or quarantining PE executables at the mail gateway or proxy before they reach the scanner - this reduces the attack surface at the cost of delayed delivery and potential business disruption. Disabling PESpin-specific scanning is not a documented option in ClamAV's standard configuration surface, so file-type filtering at the perimeter is the most actionable workaround.

More in Cisco Secure Endpoint

View all
CVE-2026-20337 HIGH
7.5 Aug 07

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning proce
CVE-2026-20348 HIGH
7.5 Aug 07

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning proce
CVE-2026-20345 HIGH
7.5 Aug 07

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially co
CVE-2026-20347 HIGH
7.5 Aug 07

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the sca
CVE-2026-20346 HIGH
7.5 Aug 07

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated re
CVE-2026-20338 HIGH
7.5 Aug 07

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the Clam

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-20339 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy