ClamAV CVE-2026-20345

The primary remediation is to apply the patch released by Cisco, referenced in the advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26. A specific fixed version is not confirmed in the available input data - retrieve the exact target version from the advisory before patching. As a compensating control pending patching, consider restricting the types of files submitted to ClamAV for scanning by disabling GPT disk-image scanning if it is not required for your use case; this directly removes the vulnerable code path but may reduce detection coverage for disk image threats. In mail gateway deployments, blocking or quarantining disk image file types (e.g., .img, .iso) at the perimeter is a targeted workaround with the trade-off of potential false positives on legitimate attachments. Generic 'network segmentation' is not actionable here because the attack surface is the scanner's file-ingestion interface, not a network port directly.