Cisco has warned that multiple ClamAV memory-corruption vulnerabilities can allow unauthenticated remote attackers to disrupt scanning operations on affected Cisco Secure Endpoint Connector installations.
The flaws, disclosed in advisory cisco-sa-clamav-WuuvVd26, affect Windows, Linux, and macOS endpoints that use the ClamAV engine to inspect files. Successful exploitation can terminate the ClamAV scanning process.
Cisco assigned affected Windows connectors a High impact rating and a CVSS base score of 7.5. The higher Windows rating reflects the privileged context in which the scanning process executes.
ClamAV Memory Corruption Bugs
Linux and macOS connectors received Medium ratings because their scanning processes run with lower privileges. Risk remains material across platforms.
Attackers need not authenticate or persuade a user to open a file to exploit the affected parser. A malicious object only needs to reach a path monitored by the connector, such as email delivery, downloads, shared storage, web transfers, or automated file ingestion.
CVE-2026-20337 is an out-of-bounds write in the ZIP archive parser, caused by insufficient boundary checks while ClamAV processes archive content.
CVE-2026-20338, also in ZIP handling, results from improper memory management that may trigger a double-free condition. Cisco said proof-of-concept exploit code is available for both vulnerabilities, requiring rapid patch deployment.
CVE-2026-20339 targets PESpin file processing and arises from an integer overflow. CVE-2026-20345, in GPT parsing, involves improper handling of endian conversion that may lead to an out-of-bounds buffer write.
Three additional bugs affect PDF, Mach-O, and XAR parsing routines. They can cause out-of-bounds reads or memory corruption when scanning crafted files.
Cisco primarily describes denial-of-service outcomes, but several bugs carry potentially broader consequences because they corrupt memory in a privileged scanning component.
The advisory does not claim confirmed remote code execution. Still, endpoint security teams should treat malformed documents and archives as risks, particularly where scanning availability is essential for prevention.
Service interruptions may have security effects beyond a single crash. If an endpoint scanner terminates while assessing a malicious file, inspection may be delayed or unavailable until recovery.
Adversaries could use crafted files to create repeated failures, reducing visibility and forcing defenders to investigate apparent reliability issues quickly.
Secure Endpoint Private Cloud itself is not directly affected, Cisco said. However, connector software distributed to endpoints from that environment remains vulnerable until updated.
Private Cloud deployments running version 4.2.8 or later will support fixed-endpoint software once Cisco releases it. Organizations should verify connector versions, policies, and rollout status.
Cisco has not reported malicious exploitation in the wild for these vulnerabilities. It is nevertheless important to recognize that public proof-of-concept code exists for CVE-2026-20337 and CVE-2026-20338.
Security teams should monitor for unexpected ClamAV process crashes, repeated scanning service restarts, and suspicious delivery of ZIP archives or malformed files across endpoints.
Administrators should prioritize Windows systems, confirm that automatic connector updates are enabled where appropriate, and rapidly deploy fixed releases as they become available. Until then, organizations can reduce exposure by applying strict controls to untrusted files.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
