Skip to main content

ClamAV CVE-2026-20348

| EUVDEUVD-2026-54508 HIGH
Classic Buffer Overflow (CWE-120)
2026-08-07 cisco GHSA-r446-3hx7-79p2
Buffer Overflow Cisco Cisco Secure Endpoint
7.5
CVSS 3.1 · Vendor: cisco
Share

Severity by source

Vendor (cisco) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

File submission over network requires no auth or interaction; only confirmed impact is process crash; scope unchanged as ClamAV crash does not pivot to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 07, 2026 - 17:08 vuln.today
CVE Published
Aug 07, 2026 - 16:42 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

AnalysisAI

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.

Technical ContextAI

ClamAV is an open-source antivirus scanning engine embedded in Cisco Secure Endpoint (formerly AMP for Endpoints), as confirmed by CPE cpe:2.3:a:cisco:cisco_secure_endpoint:*:*:*:*:*:*:*:*. The XAR (eXtensible ARchive) format originates from Apple and is used primarily for macOS software distribution packages. ClamAV's XAR parser fails to enforce proper boundary checks on archive content during the scanning pass, constituting a CWE-120 (Buffer Copy without Checking Size of Input) flaw - a classic buffer overflow where data is copied into a fixed-size buffer without adequate length validation. Depending on memory layout, heap/stack protections, and platform-level mitigations, CWE-120 flaws can sometimes escalate beyond DoS to arbitrary code execution, which aligns with Cisco's own hedged language about 'expanded impacts.'

RemediationAI

Consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 for the confirmed patched version of ClamAV and Cisco Secure Endpoint - an exact fixed version is not independently confirmed from available data and should not be inferred. As a compensating control where patching is not immediately possible, restrict file submission pathways to ClamAV scanning endpoints to trusted and known-clean sources, reducing the attacker's ability to submit arbitrary files for scanning. In environments where XAR files are not operationally expected (non-Apple ecosystems), consider disabling or filtering XAR content at the network boundary - note this reduces detection coverage for macOS-targeted malware distributed via XAR archives, so the trade-off must be weighed against risk appetite. Monitor ClamAV process health and alert on unexpected terminations as a detection signal.

More in Cisco Secure Endpoint

View all
CVE-2026-20337 HIGH
7.5 Aug 07

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning proce
CVE-2026-20345 HIGH
7.5 Aug 07

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially co
CVE-2026-20339 HIGH
7.5 Aug 07

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attac
CVE-2026-20347 HIGH
7.5 Aug 07

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the sca
CVE-2026-20346 HIGH
7.5 Aug 07

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated re
CVE-2026-20338 HIGH
7.5 Aug 07

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the Clam

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-20348 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy