Executive brief
A vulnerability in the ClamAV antivirus engine, which is used to scan files for malware, could allow an attacker to crash the scanning service. By sending a specially crafted Windows executable file (PE file) to a system protected by ClamAV, an attacker can trigger a memory error that stops the security software from functioning. This results in a denial-of-service condition where the system is no longer protected against other threats until the service is restored.
Technical details
A memory corruption vulnerability exists in the Portable Executable (PE) file format parser of ClamAV due to improper boundary checks during file scanning. This flaw manifests as an out-of-bounds buffer write when processing specially crafted PE content. An unauthenticated, remote attacker can exploit this by providing a malicious file to be scanned by the engine, leading to the termination of the ClamAV scanning process. On Windows-based platforms, such as Cisco Secure Endpoint Connector for Windows, the impact is rated High because the process runs in a privileged context and may require manual intervention or a reboot to recover. On Linux and Mac, the impact is Medium as the process runs with lower privileges and does not affect overall system stability.
Affected products
- Cisco Systems, Inc. ClamAV
- Cisco Secure Endpoint Connector for Windows Prior to 8.6.2
- Cisco Secure Endpoint Connector for Linux Prior to 1.29.0
- Cisco Secure Endpoint Connector for Mac Prior to 1.27.2
Timeline
- 2026-07-01: advisory: Cisco published the security advisory.
- 2026-07-01: disclosed: Vulnerability details and CVE-2026-20213 were made public.