Introduction
Cisco has issued a warning regarding two high-severity vulnerabilities in ClamAV, an open-source antivirus engine used in the Secure Endpoint Connector. These vulnerabilities, tracked as CVE-2026-20337 and CVE-2026-20338, allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks.
Vulnerability Details
The vulnerabilities are caused by improper boundary checks and memory handling in the ZIP archive parser of ClamAV. They affect ClamAV versions 1.5.0 through 1.5.3 and were patched in version 1.5.4 released on August 7.
Impact and Exploitation
The vulnerabilities can be exploited by unauthenticated, remote attackers. Proof-of-concept (PoC) exploit code is already publicly available, but there is no evidence that the flaws have been exploited in the wild. An attacker could submit a crafted ZIP file for scanning, causing the ClamAV scanning process to terminate and resulting in a DoS condition on the affected software.
Affected Platforms
The security flaws are only applicable to Windows platforms, as they are the only ones that run the ClamAV scanning process in a privileged security context. No workarounds are available for these vulnerabilities.
Remediation
Cisco's Product Security Incident Response Team (PSIRT) plans to release software updates later this month to address the vulnerabilities in affected versions of Secure Endpoint Connector for Windows, Linux, and Mac. No workarounds are available for CVE-2026-20337 and CVE-2026-20338.
Related Vulnerabilities
Cisco has also patched five other ClamAV security flaws that can trigger denial-of-service conditions by submitting malicious XAR, Mach-O, PDF, GPT, and PESpin files for scanning. Another ClamAV DoS vulnerability was patched with PoC exploit code in January 2025.
Conclusion
Cisco's warning highlights the importance of keeping antivirus engines up to date to protect against potential security threats. Users are advised to apply the necessary software updates to mitigate the vulnerabilities and prevent potential DoS attacks.