Skip to main content

ClamAV CVE-2026-20346

| EUVDEUVD-2026-54530 HIGH
Out-of-bounds Read (CWE-125)
2026-08-07 cisco GHSA-f8f4-wm7g-gp3c
Buffer Overflow Information Disclosure Cisco Suse Cisco Secure Endpoint
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Unauthenticated file submission via any monitored path triggers the crash; no confidentiality or integrity impact confirmed beyond scanner process termination.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 17:09 vuln.today
CVE Published
Aug 07, 2026 - 16:42 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.

Technical ContextAI

ClamAV is Cisco's open-source antivirus scanning engine, embedded as the detection core in Cisco Secure Endpoint (formerly Cisco AMP for Endpoints). The vulnerability resides in the PDF file format parser - a component responsible for iterating over and inspecting PDF document structures and object streams during signature-based and heuristic scanning. CWE-125 (Out-of-bounds Read) identifies the root cause: the parser fails to enforce proper boundary checks on content offsets or lengths when reading PDF file data, allowing reads beyond the end of an allocated buffer. PDF's flexible, object-graph structure with nested streams, indirect references, and variable-length fields creates numerous opportunities for such boundary failures when input validation is incomplete. The affected CPE cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:* uses a wildcard version, indicating Cisco has not yet bounded the affected range in the NVD CPE data - all versions should be treated as suspect until the advisory specifies otherwise.

RemediationAI

The primary fix is to apply the patched version of Cisco Secure Endpoint as specified in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26; the exact fixed version is not confirmed from available input data and must be retrieved directly from that advisory. As a compensating control, organizations can configure upstream mail gateways, web proxies, or file transfer systems to block or quarantine inbound PDF files before they reach ClamAV-scanned endpoints, which eliminates the attack surface at the cost of PDF delivery to end users. If PDF parsing is a configurable ClamAV feature in the deployment, disabling it removes exposure but reduces scan coverage for PDF-based malware. Additionally, monitoring the ClamAV process health and configuring automatic service restarts (e.g., via systemd watchdog or Cisco Secure Endpoint's own process supervision) will minimize the window of unprotected exposure following any crash. Do not treat process-restart mitigations as a fix - they reduce impact duration but do not prevent exploitation.

More in Cisco Secure Endpoint

View all
CVE-2026-20337 HIGH
7.5 Aug 07

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning proce
CVE-2026-20348 HIGH
7.5 Aug 07

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning proce
CVE-2026-20345 HIGH
7.5 Aug 07

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially co
CVE-2026-20339 HIGH
7.5 Aug 07

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attac
CVE-2026-20347 HIGH
7.5 Aug 07

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the sca
CVE-2026-20338 HIGH
7.5 Aug 07

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the Clam

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-20346 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy