CVE-2026-20244: Cisco ClamAV integer overflow in DMG file parser

CVE-2026-20244 · Severity: high · CVSS 7.5 · Published 2026-07-01

ClamAV is an open-source antivirus engine used to scan files for malicious content. A vulnerability in how it processes Apple Disk Image (DMG) files could allow an attacker to crash the scanning service by sending a specially crafted file. This results in a denial-of-service condition where the system can no longer scan new files for threats, and on Windows systems, it may require a manual reboot to restore operations.

Quick answers

Is CVE-2026-20244 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20244 being exploited in the wild.
How severe is CVE-2026-20244?
High severity, with a CVSS score of 7.5, published 1 July 2026.
Which products and versions are affected?
Cisco Systems, Inc. ClamAV; Cisco Systems, Inc. Secure Endpoint Connector for Windows Prior to 8.6.2; Cisco Systems, Inc. Secure Endpoint Connector for Linux Prior to 1.29.0; Cisco Systems, Inc. Secure Endpoint Connector for Mac Prior to 1.27.2.
Is there a fix for CVE-2026-20244?
A patch was published on 2026-07-01: Fixed versions released for Cisco Secure Endpoint products. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20244 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-20244?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CWE-120) exists in the DMG file format parser of ClamAV due to improper boundary checks during file scanning. Specifically, the flaw can lead to an integer overflow on 32-bit platforms when processing crafted DMG content, resulting in memory corruption. An unauthenticated remote attacker can exploit this by providing a malicious DMG file to be scanned, causing the ClamAV process to terminate. While primarily a DoS risk, Cisco notes that memory corruption could potentially lead to other impacts, though modern 64-bit protections mitigate code execution risks. The vulnerability is patched in ClamAV and integrated Cisco Secure Endpoint products (e.g., Windows Connector 8.6.2).

Affected products

  • Cisco Systems, Inc. ClamAV
  • Cisco Systems, Inc. Secure Endpoint Connector for Windows Prior to 8.6.2
  • Cisco Systems, Inc. Secure Endpoint Connector for Linux Prior to 1.29.0
  • Cisco Systems, Inc. Secure Endpoint Connector for Mac Prior to 1.27.2

Timeline

  • 2026-07-01: advisory: Cisco published the security advisory.
  • 2026-07-01: patched: Fixed versions released for Cisco Secure Endpoint products.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.