ClamAV Vulnerability Allows Remote Code Execution

Cisco has released an update for ClamAV to address a critical vulnerability that could allow remote code execution. The flaw, identified as CVE-2026-20215, affects the open-source antivirus engine and stems from an integer overflow during the parsing of 7z archive files.

The vulnerability, assigned a CVSS score of 8.4, specifically resides in the handling of streams within 7z files. An attacker could exploit this weakness due to insufficient validation of user-supplied data, leading to an integer overflow before a memory buffer is allocated. This condition could then be leveraged to execute arbitrary code within the context of the ClamAV process.

While interaction with the product is necessary for exploitation, the precise attack vectors may vary depending on how ClamAV is implemented in a given environment. The vulnerability is tracked as ZDI-26-583 and ZDI-CAN-29416 by the Zero Day Initiative, which credited Niv Moshe with its discovery.

Cisco, the maintainer of ClamAV, was first notified of the vulnerability on May 20, 2026. A coordinated public release of the advisory and the corresponding update occurred on August 13, 2026. Users are strongly advised to apply the latest update to mitigate the risk posed by this flaw. Further details and the security advisory are available on Cisco's security center.