Skip to main content

Cisco Secure Endpoint

7 CVEs product

Monthly

CVE-2026-20348 Aug 07, 16:42 HIGH This Week

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.

Buffer Overflow Cisco Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20345 Aug 07, 16:42 HIGH This Week

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.

Buffer Overflow Cisco Stack Overflow Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20339 Aug 07, 16:42 HIGH This Week

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.

Buffer Overflow Integer Overflow Cisco Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20347 Aug 07, 16:42 HIGH This Week

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.

Buffer Overflow Information Disclosure Cisco Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20346 Aug 07, 16:42 HIGH This Week

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.

Buffer Overflow Information Disclosure Cisco Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20338 Aug 07, 16:41 HIGH This Week

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.

Information Disclosure Cisco Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.3%
CVE-2026-20337 Aug 07, 16:41 HIGH This Week

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.

Buffer Overflow Cisco Suse Cisco Secure Endpoint
NVD VulDB
CVSS 3.1
7.5
EPSS
0.4%
EPSS 0% CVSS 7.5
HIGH This Week

Memory corruption in ClamAV's XAR file format parser allows remote unauthenticated attackers to crash the scanning process by submitting a specially crafted XAR archive to any service fronted by ClamAV, including Cisco Secure Endpoint deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, unauthenticated network exploitation with no user interaction required. Cisco's own description hedges the impact beyond DoS - noting 'possibly other expanded impacts as a result of memory corruption' - which, given the CWE-120 root cause, means RCE potential cannot be ruled out pending deeper analysis. No public exploit identified at time of analysis.

Buffer Overflow Cisco Cisco Secure Endpoint
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

Remote unauthenticated exploitation of ClamAV's GPT file format parser can crash the scanning process and potentially corrupt memory on affected Cisco Secure Endpoint deployments. The root cause is a faulty endian conversion in the GPT parser that writes out-of-bounds on the stack (CWE-121), reachable by any attacker who can submit a file for scanning - a condition met by default in mail gateway, web proxy, and endpoint deployments. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis, but the CVSS AV:N/AC:L/PR:N/UI:N profile means exploitation requires no special access and is trivially automatable.

Buffer Overflow Cisco Stack Overflow +2
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

Memory corruption in ClamAV's PESpin file format parser within Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PESpin-packed PE file. The root cause is improper boundary checks that trigger an integer overflow (CWE-190) during scan-time parsing, resulting in a denial-of-service condition and the vendor notes the possibility of expanded impacts beyond DoS due to the underlying memory corruption. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity and zero authentication requirement (AV:N/AC:L/PR:N/UI:N) make exploitation straightforward for any attacker who can route a file through the scanner.

Buffer Overflow Integer Overflow Cisco +2
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.

Buffer Overflow Information Disclosure Cisco +2
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.

Buffer Overflow Information Disclosure Cisco +2
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.

Information Disclosure Cisco Suse +1
NVD VulDB
EPSS 0% CVSS 7.5
HIGH This Week

ClamAV's zip archive parser in Cisco Secure Endpoint allows unauthenticated remote attackers to crash the scanning process by submitting a specially crafted zip file, resulting in a denial-of-service condition. The flaw stems from an out-of-bounds write (CWE-120) caused by missing boundary validation on zip file content during parsing. No public exploit code or active exploitation has been identified at time of analysis, but the fully remote, zero-authentication CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker able to route malicious files through a ClamAV-enabled scanner can reliably trigger the crash.

Buffer Overflow Cisco Suse +1
NVD VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy