CVE-2026-20217: Cisco ClamAV out-of-bounds write in PESpin file parser

CVE-2026-20217 · Severity: high · CVSS 7.5 · Published 2026-07-01

A vulnerability in the ClamAV antivirus engine, used in various Cisco security products, could allow an attacker to crash the scanning service. By sending a specially crafted file to be scanned, an attacker can cause the software to stop functioning, creating a denial-of-service condition. On Windows systems, this is particularly severe as the scanning process runs with high privileges and may require a manual reboot to recover.

Technologies: Cisco ClamAV. Vendors: Cisco.

Quick answers

Is CVE-2026-20217 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20217 being exploited in the wild.
How severe is CVE-2026-20217?
High severity, with a CVSS score of 7.5, published 1 July 2026.
Which products and versions are affected?
Cisco ClamAV All versions prior to fixed releases; Cisco Secure Endpoint Connector Before 8.6.2.
Is there a fix for CVE-2026-20217?
A patch was published on 2026-07-01: Fixed versions released for Cisco Secure Endpoint products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20217 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20217?
Check whether you run Cisco ClamAV or Cisco Secure Endpoint Connector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in the PESpin file format parser of ClamAV due to improper boundary checks during file scanning. This flaw allows an unauthenticated, remote attacker to trigger an out-of-bounds buffer write by submitting a specially crafted PESpin file. A successful exploit can lead to the termination of the ClamAV scanning process, resulting in a denial-of-service (DoS) condition. While primarily a DoS risk, the memory corruption could potentially lead to other impacts, though Cisco notes that modern memory protections make remote code execution difficult. Patches have been released for affected Cisco Secure Endpoint Connectors.

Affected products

  • Cisco Secure Endpoint Connector for Windows Before 8.6.2
  • Cisco Secure Endpoint Connector for Linux Before 1.29.0
  • Cisco Secure Endpoint Connector for Mac Before 1.27.2
  • Cisco ClamAV All versions prior to fixed releases

Timeline

  • 2026-07-01: disclosed: Initial advisory publication by Cisco and NVD
  • 2026-07-01: patched: Fixed versions released for Cisco Secure Endpoint products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.