Cisco has issued a warning regarding seven vulnerabilities discovered in ClamAV, an open-source antivirus engine, which affect its Secure Endpoint Connector products across Windows, macOS, and Linux platforms. Two of these flaws, identified as CVE-2026-20337 and CVE-2026-20338, have publicly available proof-of-concept (PoC) exploit code, raising concerns about potential denial-of-service (DoS) attacks.
ClamAV is widely deployed for scanning files and emails for malicious content. Cisco's advisory indicates that the vulnerabilities could allow an unauthenticated, remote attacker to trigger a DoS condition, thereby interrupting scanning operations. The company's Product Security Incident Response Team (PSIRT) has confirmed the existence of PoC exploits for CVE-2026-20337 and CVE-2026-20338 but states there is no evidence of these vulnerabilities being exploited in the wild.
The seven vulnerabilities, tracked with CVE IDs ranging from CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, primarily impact ClamAV parsers for various file formats. These issues have been addressed in ClamAV version 1.5.4.
Specifically, CVE-2026-20337, with a CVSS score of 7.5, is described as an out-of-bounds write vulnerability in ClamAV's zip archive parser. This flaw stems from inadequate boundary checks during the scanning of zip files. An attacker could exploit this by submitting a specially crafted zip file, leading to the termination of the ClamAV scanning process and a DoS condition.
CVE-2026-20338, also with a CVSS score of 7.5, is a memory corruption vulnerability, also within the zip archive parser. This vulnerability is attributed to improper memory handling when processing zip file content. A malicious zip file could cause a memory double-free, resulting in the ClamAV scanning process crashing and a DoS condition.
Cisco has identified its Secure Endpoint Connector for Windows, macOS, and Linux as affected products. The risk is considered high for Windows systems because ClamAV typically operates with elevated privileges on that platform, while macOS and Linux installations face a medium risk. Cisco Secure Endpoint Private Cloud is not directly affected, but customers must ensure that fixes are distributed to their endpoints.
While no workarounds are available, Cisco plans to release patches for the affected Secure Endpoint Connector products in August 2026. Customers are advised to consult the related bug IDs in Cisco's advisory for specific details on each vulnerability and the forthcoming fixes.
