Full Report
Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks. [...]
Analysis Summary
# Vulnerability: Cisco ClamAV ZIP Parser Denial-of-Service
## CVE Details
- **CVE ID:** CVE-2026-20337 and CVE-2026-20338
- **CVSS Score:** High (Specific score not provided in text, but categorized as "High-Severity")
- **CWE:** Improper Boundary Checks (CVE-2026-20337) and Improper Memory Handling (CVE-2026-20338)
## Affected Systems
- **Products:**
- Clam AntiVirus (ClamAV) engine
- Cisco Secure Endpoint Connector (Windows, Linux, and Mac)
- **Versions:**
- ClamAV versions 1.5.0 through 1.5.3
- **Configurations:**
- Impact is highest on **Windows platforms** where the ClamAV scanning process runs in a privileged security context.
## Vulnerability Description
The vulnerabilities exist within the ClamAV **ZIP archive parser**.
- **CVE-2026-20337** is caused by improper boundary checks.
- **CVE-2026-20338** is caused by improper memory handling.
By submitting a specially crafted ZIP file for scanning, a remote, unauthenticated attacker can trigger these flaws to cause the ClamAV scanning process to terminate unexpectedly.
## Exploitation
- **Status:** PoC available; Not currently observed being exploited in the wild.
- **Complexity:** Low (Implied by the nature of submitting a file for scanning).
- **Attack Vector:** Remote (Unauthenticated).
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** **High** (Causes a Denial-of-Service (DoS) condition by crashing the scanning engine, preventing further malware detection).
## Remediation
### Patches
- **ClamAV:** Update to version **1.5.4** (released August 7, 2026).
- **Cisco Secure Endpoint Connector:** Software updates for Windows, Linux, and Mac are scheduled for release in late August 2026.
### Workarounds
- There are **no known workarounds** for these specific vulnerabilities.
## Detection
- **Indicators of Compromise:** Unexpected termination or frequent crashing of the ClamAV scanning process (`clamd` or related service) when processing specific ZIP archives.
- **Detection methods:** Monitor system logs for ClamAV service failures and audit incoming ZIP files if advanced inspection tools are available.
## References
- **Vendor Advisory:** hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26
- **ClamAV Blog:** hxxps[://]blog[.]clamav[.]net/2026/08/clamav-154-and-146-security-patch[.]html
- **GitHub Advisory (2026-20337):** hxxps[://]github[.]com/advisories/GHSA-rhg3-hwfw-hp7p
- **GitHub Advisory (2026-20338):** hxxps[://]github[.]com/advisories/GHSA-xw98-8fcm-j8x7