Skip to main content

ClamAV CVE-2026-20347

| EUVDEUVD-2026-54532 HIGH
Out-of-bounds Read (CWE-125)
2026-08-07 cisco GHSA-mph8-4p68-pr43
Buffer Overflow Information Disclosure Cisco Suse Cisco Secure Endpoint
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

File delivery triggers automatic unauthenticated scanning with no UI; confirmed impact is process termination only, with confidentiality unconfirmed despite OOB-read primitive.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 17:09 vuln.today
CVE Published
Aug 07, 2026 - 16:42 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted Mach-O file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.

Technical ContextAI

ClamAV is an antivirus scanning engine that parses numerous binary formats, including Mach-O - the executable and object file format used by Apple macOS and iOS. CWE-125 (Out-of-bounds Read) identifies the root cause: the Mach-O parser fails to enforce proper buffer boundaries when reading file content, allowing a malformed file to trigger reads into adjacent memory. This class of defect in automated parsing engines is especially dangerous because scanning occurs without user interaction and is reachable from any delivery channel. The confirmed affected product per CPE cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:* is Cisco Secure Endpoint, Cisco's enterprise EDR product that integrates ClamAV as its file scanning engine. The wildcard version field in the CPE indicates no specific safe version has been published in the available intelligence. The 'Information Disclosure' and 'Buffer Overflow' tags, combined with CWE-125, suggest the OOB read may expose adjacent heap or stack contents in addition to causing process termination - a potential secondary impact not captured in the CVSS A:H-only scoring.

RemediationAI

Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 for the specific patched version of Cisco Secure Endpoint; the exact fix version was not present in available intelligence, so patch availability is confirmed per vendor advisory only - upgrade to the version specified in that document. As a compensating control pending upgrade, restrict which file types reach the ClamAV scanning engine by filtering or blocking Mach-O content at upstream email gateway or web proxy layers (e.g., blocking files with Mach-O magic bytes or Apple binary MIME types); this reduces attack surface but leaves macOS executables temporarily unscanned, which is a meaningful trade-off in environments with macOS endpoints. If Cisco Secure Endpoint policy supports file-type exclusions for scanning scope, configuring Mach-O exclusion is a targeted workaround with the same trade-off of bypassing malware detection for that format.

More in Cisco Secure Endpoint

View all
CVE-2026-20337 HIGH
7.5 Aug 07

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning proce
CVE-2026-20348 HIGH
7.5 Aug 07

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning proce
CVE-2026-20345 HIGH
7.5 Aug 07

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially co
CVE-2026-20339 HIGH
7.5 Aug 07

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attac
CVE-2026-20346 HIGH
7.5 Aug 07

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated re
CVE-2026-20338 HIGH
7.5 Aug 07

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the Clam

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-20347 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy