CVE-2026-20213: ClamAV out-of-bounds write in PE file format parser

CVE-2026-20213 · Severity: high · CVSS 7.5 · Published 2026-07-01

A vulnerability in the ClamAV antivirus engine, which is used to scan files for malware, could allow an attacker to crash the scanning service. By sending a specially crafted Windows executable file (PE file) to a system protected by ClamAV, an attacker can trigger a memory error that stops the security software from functioning. This results in a denial-of-service condition where the system is no longer protected against other threats until the service is restored.

Technologies: Cisco ClamAV, Cisco Secure Endpoint Connector for Linux, Cisco Secure Endpoint Connector for Mac, Cisco Secure Endpoint Connector for Windows. Vendors: Cisco.

Quick answers

Is CVE-2026-20213 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20213 being exploited in the wild.
How severe is CVE-2026-20213?
High severity, with a CVSS score of 7.5, published 1 July 2026.
Which products and versions are affected?
Cisco Secure Endpoint Connector for Linux Prior to 1.29.0; Cisco Secure Endpoint Connector for Mac Prior to 1.27.2; Cisco Secure Endpoint Connector for Windows Prior to 8.6.2.
Is there a fix for CVE-2026-20213?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20213 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-20213?
Check whether you run Cisco ClamAV, Cisco Secure Endpoint Connector for Linux, Cisco Secure Endpoint Connector for Mac or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in the Portable Executable (PE) file format parser of ClamAV due to improper boundary checks during file scanning. This flaw manifests as an out-of-bounds buffer write when processing specially crafted PE content. An unauthenticated, remote attacker can exploit this by providing a malicious file to be scanned by the engine, leading to the termination of the ClamAV scanning process. On Windows-based platforms, such as Cisco Secure Endpoint Connector for Windows, the impact is rated High because the process runs in a privileged context and may require manual intervention or a reboot to recover. On Linux and Mac, the impact is Medium as the process runs with lower privileges and does not affect overall system stability.

Affected products

  • Cisco Systems, Inc. ClamAV
  • Cisco Secure Endpoint Connector for Windows Prior to 8.6.2
  • Cisco Secure Endpoint Connector for Linux Prior to 1.29.0
  • Cisco Secure Endpoint Connector for Mac Prior to 1.27.2

Timeline

  • 2026-07-01: advisory: Cisco published the security advisory.
  • 2026-07-01: disclosed: Vulnerability details and CVE-2026-20213 were made public.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.