Skip to main content

ClamAV EUVDEUVD-2026-41080

| CVE-2026-20213 HIGH
Classic Buffer Overflow (CWE-120)
2026-07-01 psirt@cisco.com GHSA-rjvx-x4g3-vr6w
Buffer Overflow Cisco Red Hat Secure Endpoint Suse
7.5
CVSS 3.1 · Vendor: cisco
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed PE file
  2. Delivery
    Submit file to ClamAV scan path
  3. Exploit
    Trigger out-of-bounds write in PE parser
  4. Execution
    Corrupt memory / crash scanner process
  5. Impact
    Denial of service on scanning

Vulnerability Assessment

Weakness
CWE
CWE-120
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The concrete prerequisite is that the target must scan attacker-supplied files with ClamAV and that PE (Windows executable) content reaches the parser - the crafted file must contain PE content to be scanned on the affected device. No authentication, privileges, or user interaction are required (PR:N/UI:N), so any ingestion path that forwards untrusted files to ClamAV (email attachment scanning, upload scanning, proxy scanning) satisfies the condition. Limiting factors: exploitation depends on ClamAV actually processing the malicious file through the PE parser, so environments that do not scan executables or that block/strip PE content before scanning are not exposed; the confirmed outcome is limited to crashing the scan process (availability), not compromise of scanned data.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: any file that reaches a scanner is 'network' reachable, requires no privileges or user interaction, and the only confirmed impact is availability (process termination). This is a real operational concern because ClamAV frequently sits inline on untrusted input (email, uploads), so a single crafted attachment can crash scanning and, depending on deployment, fail-open or fail-closed. However, the confirmed impact is DoS only - C:N/I:N means no data compromise. The description's 'possibly other expanded impacts... from memory corruption' is speculative and NOT reflected in the CVSS impact metrics, so it should not be treated as confirmed code execution. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input; absence of these signals suggests no evidence of active or automatable exploitation at this time, but they were simply not supplied rather than confirmed negative. Net: a credible, easy-to-trigger availability issue worth prompt patching, but not currently an exploitation emergency.
Exploit ScenarioDerived

An attacker emails or uploads a specially crafted PE file to a service that scans inbound content with ClamAV (e.g., a mail gateway or file-upload handler). When ClamAV parses the malformed PE structure, the out-of-bounds write terminates the scanning process, disrupting scanning for all users behind that instance. Given AV:N/AC:L/PR:N/UI:N, no authentication, privileges, or victim interaction are required; no public POC was identified in the provided data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 01, 2026

Denial of service in ClamAV's PE (Portable Executable) file format parser lets an unauthenticated, remote attacker crash the scanning engine by submitting a crafted PE file for scanning, triggering an out-of-bounds buffer write (CWE-120). Reported by Cisco PSIRT (ClamAV's maintainer), the flaw carries CVSS 7.5 with an availability-only impact; the advisory notes memory corruption could 'possibly' enable expanded impacts beyond DoS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

RemediationAI

Upgrade ClamAV to a fixed release as directed by the Cisco/ClamAV advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR); the exact patched version was not included in the provided data, so confirm the target version directly from that advisory before deploying. If immediate patching is not possible, the most targeted compensating control is to reduce exposure of the PE parser: where the environment does not need to scan Windows executables, disabling or filtering PE scanning (or blocking/quarantining executable content upstream before it reaches ClamAV) limits reachability, at the trade-off of reduced malware coverage for executables. Additionally, run clamd under a supervisor/watchdog (e.g., systemd restart, monitored service) and rate-limit untrusted scan sources so that a crash-loop degrades gracefully rather than causing a sustained outage; note this mitigates availability impact but does not fix the underlying memory corruption.

Affected VersionsENISA

Cisco Secure Endpoint 1.22.3
Cisco Secure Endpoint 7.4.3.20679
Cisco Secure Endpoint 1.18.1
Cisco Secure Endpoint 7.4.3
Cisco Secure Endpoint 7.4.1.20439
Cisco Secure Endpoint 7.3.13
Cisco Secure Endpoint 8.4.0
Cisco Secure Endpoint 8.1.3
Cisco Secure Endpoint 8.1.7
Cisco Secure Endpoint 8.4.4.30419
Cisco Secure Endpoint 1.20.6
Cisco Secure Endpoint 6.2.19
Cisco Secure Endpoint 1.15.6
Cisco Secure Endpoint 7.5.21.21732
Cisco Secure Endpoint 1.12.5
Cisco Secure Endpoint 1.9.0
Cisco Secure Endpoint 1.8.0
Cisco Secure Endpoint 7.5.3
Cisco Secure Endpoint 1.16.3
Cisco Secure Endpoint 7.2.13
Cisco Secure Endpoint 1.15.2
Cisco Secure Endpoint 8.2.3.30119
Cisco Secure Endpoint 7.3.3
Cisco Secure Endpoint 1.20.2
Cisco Secure Endpoint 7.4.5
Cisco Secure Endpoint 1.8.1
Cisco Secure Endpoint 1.25.0
Cisco Secure Endpoint 1.25.1
Cisco Secure Endpoint 8.1.7.21417
Cisco Secure Endpoint 7.1.1
Cisco Secure Endpoint 6.1.5
Cisco Secure Endpoint 1.19.0
Cisco Secure Endpoint 7.2.5
Cisco Secure Endpoint 8.1.7.21512
Cisco Secure Endpoint 7.5.1.20833
Cisco Secure Endpoint 1.23.1
Cisco Secure Endpoint 7.5.9
Cisco Secure Endpoint 8.1.3.21242
Cisco Secure Endpoint 7.3.15
Cisco Secure Endpoint 1.16.1
Cisco Secure Endpoint 1.22.4
Cisco Secure Endpoint 1.21.3
Cisco Secure Endpoint 7.4.1
Cisco Secure Endpoint 1.13.0
Cisco Secure Endpoint 1.13.2
Cisco Secure Endpoint 7.5.19
Cisco Secure Endpoint 7.2.7
Cisco Secure Endpoint 1.12.3
Cisco Secure Endpoint 1.24.1
Cisco Secure Endpoint 1.27.1
Cisco Secure Endpoint 1.22.2
Cisco Secure Endpoint 1.14.1
Cisco Secure Endpoint 1.22.1
Cisco Secure Endpoint 1.15.5
Cisco Secure Endpoint 1.24.3
Cisco Secure Endpoint 8.1.5.21322
Cisco Secure Endpoint 7.5.1.20813
Cisco Secure Endpoint 1.20.0
Cisco Secure Endpoint 1.24.4
Cisco Secure Endpoint 1.13.1
Cisco Secure Endpoint 1.24.5
Cisco Secure Endpoint 1.12.0
Cisco Secure Endpoint 6.1.9
Cisco Secure Endpoint 1.25.2
Cisco Secure Endpoint 1.12.4
Cisco Secure Endpoint 7.5.13.21586
Cisco Secure Endpoint 1.21.2
Cisco Secure Endpoint 8.1.5
Cisco Secure Endpoint 8.2.1.21650
Cisco Secure Endpoint 7.2.3
Cisco Secure Endpoint 1.8.4
Cisco Secure Endpoint 1.16.2
Cisco Secure Endpoint 8.2.4.30130
Cisco Secure Endpoint 1.22.0
Cisco Secure Endpoint 1.15.4
Cisco Secure Endpoint 8.1.7.21585
Cisco Secure Endpoint 1.16.0
Cisco Secure Endpoint 7.5.7
Cisco Secure Endpoint 1.10.2
Cisco Secure Endpoint 6.3.7
Cisco Secure Endpoint 6.3.5
Cisco Secure Endpoint 1.15.1
Cisco Secure Endpoint 1.10.0
Cisco Secure Endpoint 8.0.1.21164
Cisco Secure Endpoint 1.26.0
Cisco Secure Endpoint 6.3.3
Cisco Secure Endpoint 8.2.1.21612
Cisco Secure Endpoint 1.17.2
Cisco Secure Endpoint 6.2.9
Cisco Secure Endpoint 1.20.7
Cisco Secure Endpoint 1.20.5
Cisco Secure Endpoint 8.0.1.21160
Cisco Secure Endpoint 1.21.0
Cisco Secure Endpoint 1.11.0
Cisco Secure Endpoint 1.12.7
Cisco Secure Endpoint 7.5.15.21611
Cisco Secure Endpoint 1.21.1
Cisco Secure Endpoint 1.20.3
Cisco Secure Endpoint 6.0.7
Cisco Secure Endpoint 1.23.0
Cisco Secure Endpoint 8.4.1.30307
Cisco Secure Endpoint 1.20.1
Cisco Secure Endpoint 7.3.1
Cisco Secure Endpoint 1.27.0
Cisco Secure Endpoint 1.26.1
Cisco Secure Endpoint 6.3.1
Cisco Secure Endpoint 1.10.1
Cisco Secure Endpoint 8.4.1.30298
Cisco Secure Endpoint 7.5.20
Cisco Secure Endpoint 1.6.0
Cisco Secure Endpoint 1.12.1
Cisco Secure Endpoint 1.24.0
Cisco Secure Endpoint 7.5.13.21598
Cisco Secure Endpoint 1.12.2
Cisco Secure Endpoint 7.5.17.21680
Cisco Secure Endpoint 8.4.3
Cisco Secure Endpoint 1.7.0
Cisco Secure Endpoint 8.4.2.30317
Cisco Secure Endpoint 8.4.4.30467
Cisco Secure Endpoint 7.2.11
Cisco Secure Endpoint 7.3.5
Cisco Secure Endpoint 1.18.0
Cisco Secure Endpoint 1.14.0
Cisco Secure Endpoint 6.1.7
Cisco Secure Endpoint 7.5.11
Cisco Secure Endpoint 7.0.5
Cisco Secure Endpoint 6.0.9
Cisco Secure Endpoint 8.4.5.30483
Cisco Secure Endpoint 1.12.6
Cisco Secure Endpoint 7.5.5
Cisco Secure Endpoint 7.1.5
Cisco Secure Endpoint 1.15.3
Cisco Secure Endpoint 6.2.5
Cisco Secure Endpoint 1.20.4
Cisco Secure Endpoint 1.11.1
Cisco Secure Endpoint 1.20.8
Cisco Secure Endpoint 7.4.1.20425
Cisco Secure Endpoint 6.2.3
Cisco Secure Endpoint 1.9.1
Cisco Secure Endpoint 1.15.0
Cisco Secure Endpoint 6.2.1
Cisco Secure Endpoint 7.3.9
Cisco Secure Endpoint 1.17.0
Cisco Secure Endpoint 1.17.1
Cisco Secure Endpoint 1.24.2
Cisco Secure Endpoint 1.27.2

Affected Packages

euvd cisco_secure_endpoint no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ClamAV is a widely used open-source antivirus engine (maintained by Cisco/Talos) commonly embedded in mail gateways, file-upload scanners, proxies, and endpoint agents. The defect lives in the engine's PE file parser, the component that dissects Windows executable structure (DOS/PE headers, section tables, data directories) to inspect and unpack executables during a scan. Per the description, improper boundary checks on content within PE files produce an out-of-bounds buffer write, the classic CWE-120 buffer copy without size validation. Because ClamAV scans attacker-supplied content by design, the parser is directly reachable by any file that reaches the scanning path.

Know when Secure Endpoint gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (cisco) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Any untrusted file reaching the scanner is network-reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); confirmed impact is process crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Executive ViewAI

Why It Matters

ClamAV's PE file parser contains a denial-of-service vulnerability (CVE-2026-20213, CVSS 7.5) that allows unauthenticated attackers to crash the scanning engine by submitting crafted PE files, temporarily disabling malware detection capabilities across affected systems. Organizations relying on ClamAV face a window where threats cannot be scanned, requiring immediate compensating controls and upgrade planning.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to ClamAV scanning service to trusted internal networks only; (2) Implement input validation to reject PE files with malformed headers before reaching ClamAV; (3) Deploy IPS/WAF rules targeting malformed PE signatures; (4) Enable detailed scanning engine logs and alerts for crash events; (5) Maintain alternative malware detection capability or offline scanning queue to preserve security posture during potential DoS events.

Threat Intelligence Overview

EPSS Score
0.5%
Top 63% exploitable
Prevalence
High
widely embedded open-source AV in mail gateways and file scanners
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Secure Endpoint

View all
CVE-2023-20032 CRITICAL
9.8 Mar 01

On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ p
CVE-2026-20214 HIGH
7.5 Jul 01

Denial of service in ClamAV's FSG file format parser allows an unauthenticated remote attacker to crash the scanning eng
CVE-2026-20244 HIGH
7.5 Jul 01

Denial of service in ClamAV's DMG file format parser allows a remote, unauthenticated attacker to crash the scanning eng
CVE-2026-20243 HIGH
7.5 Jul 01

Denial of service in ClamAV's ALZ archive parser allows an unauthenticated, remote attacker to crash the scanning engine
CVE-2026-20217 HIGH
7.5 Jul 01

Availability-impacting out-of-bounds write in ClamAV's PESpin file-format parser lets an unauthenticated remote attacker
CVE-2026-20216 HIGH
7.5 Jul 01

Denial of service in ClamAV's InstallShield file format parser allows a remote, unauthenticated attacker (per CVSS PR:N)
CVE-2026-20215 HIGH
7.5 Jul 01

Denial of service in ClamAV's 7z archive scanner allows a remote, unauthenticated attacker to crash the scanning process
CVE-2023-20212 HIGH
7.5 Aug 18

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of serv
CVE-2023-20197 HIGH
7.5 Aug 16

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthe
CVE-2022-20785 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20771 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a
CVE-2022-20770 HIGH
7.5 May 04

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 a

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-20213 ADVISORY https://ubuntu.com/security/notices/USN-8517-1 ADVISORY https://vuldb.com/vuln/375620 REF https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy