# CVE-2026-20216: Cisco ClamAV denial of service in InstallShield parser

Source: https://junglewise.ai/threats/cve-2026-20216-cisco-clamav-denial-of-service-in-installshield-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-20216 · Severity: high · CVSS 7.5 · Published 2026-07-01

A vulnerability in the ClamAV antivirus engine could allow an attacker to crash the scanning service by providing a specially crafted InstallShield file. This affects security products that use ClamAV to scan files, such as Cisco Secure Endpoint. An exploit would stop the system from scanning for threats and could temporarily exhaust system resources, leading to a denial-of-service condition.

Technologies: [Cisco ClamAV](https://junglewise.ai/threats/technologies/clamav), [Cisco Secure Endpoint Connector for Linux](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-linux), [Cisco Secure Endpoint Connector for Mac](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-mac), [Cisco Secure Endpoint Connector for Windows](https://junglewise.ai/threats/technologies/secure-endpoint-connector-for-windows). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20216 being exploited in the wild.

**How severe is CVE-2026-20216?** High severity, with a CVSS score of 7.5, published 1 July 2026.

**Which products and versions are affected?** Cisco Secure Endpoint Connector for Linux Prior to 1.29.0; Cisco Secure Endpoint Connector for Mac Prior to 1.27.2; Cisco Secure Endpoint Connector for Windows Prior to 8.6.2.

**Is there a fix for CVE-2026-20216?** A patch was published on 2026-07-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20216 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-20216?** Check whether you run Cisco ClamAV, Cisco Secure Endpoint Connector for Linux, Cisco Secure Endpoint Connector for Mac or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the InstallShield file format parser of ClamAV (CWE-770) due to improper handling of temporary resources during file scanning. An unauthenticated remote attacker can exploit this by submitting a crafted InstallShield file for scanning. Successful exploitation results in the termination of the ClamAV scanning process and temporary consumption of system resources, leading to a denial-of-service (DoS) condition. On Windows-based platforms, this is rated as High severity because the process runs in a privileged context, whereas on Linux and Mac, it is rated as Medium. Cisco has released updates for affected Secure Endpoint products to address this issue.

## Affected products

- Cisco ClamAV
- Cisco Secure Endpoint Connector for Windows Prior to 8.6.2
- Cisco Secure Endpoint Connector for Linux Prior to 1.29.0
- Cisco Secure Endpoint Connector for Mac Prior to 1.27.2

## Timeline

- 2026-07-01: disclosed
- 2026-07-01: patched
- 2026-07-01: advisory

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR)

## Related threats

- [Cisco ClamAV out-of-bounds write in ALZ file format parser](https://junglewise.ai/threats/cve-2026-20243-cisco-clamav-out-of-bounds-write-in-alz-file-format-parser)
- [Cisco ClamAV out-of-bounds write in PESpin file parser](https://junglewise.ai/threats/cve-2026-20217-cisco-clamav-out-of-bounds-write-in-pespin-file-parser)
- [ClamAV out-of-bounds write in 7z file format parser](https://junglewise.ai/threats/cve-2026-20215-clamav-out-of-bounds-write-in-7z-file-format-parser)
- [Cisco ClamAV out-of-bounds write in FSG file parser](https://junglewise.ai/threats/cve-2026-20214-cisco-clamav-out-of-bounds-write-in-fsg-file-parser)
- [ClamAV out-of-bounds write in PE file format parser](https://junglewise.ai/threats/cve-2026-20213-clamav-out-of-bounds-write-in-pe-file-format-parser)