# CVE-2026-20214: Cisco ClamAV out-of-bounds write in FSG file parser

Source: https://junglewise.ai/threats/cve-2026-20214-cisco-clamav-out-of-bounds-write-in-fsg-file-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-20214 · Severity: high · CVSS 7.5 · Published 2026-07-01

A vulnerability in the ClamAV antivirus engine could allow an attacker to crash the scanning service by providing a specially crafted file. ClamAV is widely used to scan emails and files for malware; if the scanner crashes, it can stop protecting the system or cause the entire computer to become unresponsive. On Windows systems, this is particularly serious as it may require a manual reboot to restore security protections.

Technologies: [Cisco ClamAV](https://junglewise.ai/threats/technologies/clamav), [Cisco Secure Endpoint Connector for Linux](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-linux), [Cisco Secure Endpoint Connector for Mac](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-mac), [Cisco Secure Endpoint Connector for Windows](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-windows). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20214 being exploited in the wild.

**How severe is CVE-2026-20214?** High severity, with a CVSS score of 7.5, published 1 July 2026.

**Which products and versions are affected?** Cisco Secure Endpoint Connector for Linux Prior to 1.29.0; Cisco Secure Endpoint Connector for Mac Prior to 1.27.2; Cisco Secure Endpoint Connector for Windows Prior to 8.6.2.

**Is there a fix for CVE-2026-20214?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20214 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-20214?** Check whether you run Cisco ClamAV, Cisco Secure Endpoint Connector for Linux, Cisco Secure Endpoint Connector for Mac or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory corruption vulnerability exists in the FSG (Fast Small Good) file format parser of ClamAV due to improper boundary checks during the scanning of compressed portable executable (PE) content. An unauthenticated remote attacker can exploit this by submitting a crafted FSG-compressed file, triggering an out-of-bounds buffer write. This results in the termination of the ClamAV scanning process, leading to a denial of service. On Windows platforms, where the process runs with higher privileges, this may lead to system instability or require a reboot. Cisco has released updates for affected products including Secure Endpoint Connectors.

## Affected products

- Cisco Systems, Inc. ClamAV
- Cisco Secure Endpoint Connector for Windows Prior to 8.6.2
- Cisco Secure Endpoint Connector for Linux Prior to 1.29.0
- Cisco Secure Endpoint Connector for Mac Prior to 1.27.2

## Timeline

- 2026-07-01: advisory: Cisco published the security advisory.
- 2026-07-01: disclosed: CVE-2026-20214 published to NVD.

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR)

## Related threats

- [Cisco ClamAV out-of-bounds write in ALZ file format parser](https://junglewise.ai/threats/cve-2026-20243-cisco-clamav-out-of-bounds-write-in-alz-file-format-parser)
- [Cisco ClamAV out-of-bounds write in PESpin file parser](https://junglewise.ai/threats/cve-2026-20217-cisco-clamav-out-of-bounds-write-in-pespin-file-parser)
- [Cisco ClamAV denial of service in InstallShield parser](https://junglewise.ai/threats/cve-2026-20216-cisco-clamav-denial-of-service-in-installshield-parser)
- [ClamAV out-of-bounds write in 7z file format parser](https://junglewise.ai/threats/cve-2026-20215-clamav-out-of-bounds-write-in-7z-file-format-parser)
- [ClamAV out-of-bounds write in PE file format parser](https://junglewise.ai/threats/cve-2026-20213-clamav-out-of-bounds-write-in-pe-file-format-parser)