Cisco Warns of High-Severity ClamAV ZIP Parsing Flaws with Public Exploit Code

Public proof-of-concept exploit code is now available for two high-severity Cisco ClamAV vulnerabilities, tracked as CVE-2026-20337 and CVE-2026-20338. The security flaws stem from improper memory and boundary handling in ClamAV’s archive parsing engine when processing ZIP files, allowing unauthenticated, remote attackers to crash the scanning daemon on demand. Because the open-source engine powers Cisco Secure Endpoint Connector as well as standalone mail gateways, network appliances, and file-upload validation pipelines, terminating the process effectively blinds security monitoring across affected hosts.

Cisco ClamAV Vulnerabilities and Parser Mechanics

Antivirus engines rely on deep-file parsing to unpack and inspect compressed formats before executing signature matching or heuristic analysis. When an engine processes nested or malformed archives, it must carefully validate array boundaries and allocate dynamic memory safely.

The two flaws reside within ClamAV’s ZIP archive parser module:

• CVE-2026-20337 involves improper boundary checks when reading compressed ZIP archive headers and entry metadata. When presented with a specifically manipulated ZIP payload, the parser attempts out-of-bounds memory accesses, triggering an unhandled exception that crashes the process.
• CVE-2026-20338 stems from improper memory handling during archive extraction and buffer management. An attacker can construct a payload that leads to memory corruption, forcing the host scanning engine to abort execution immediately.

Because both bugs are exposed directly through the scanning engine’s entry point, an attacker does not need system credentials or local network access. Any automated workflow that submits external files for security inspection—such as an inbound mail server, a web application file-upload portal, or an automated file-transfer share—serves as an attack vector. Submitting a single crafted ZIP file through these channels is sufficient to achieve a total denial-of-service (DoS) condition on the scanner.

Operational Impact and Blast Radius

While denial-of-service vulnerabilities in standard user applications carry moderate risk, DoS conditions in endpoint security tools present a severe structural threat. Security software acts as a critical line of defense; when the engine crashes, security teams face specific operational hazards:

1. Blind Spot Creation: Attackers frequently employ DoS exploits as part of a multi-stage intrusion sequence. By delivering a malformed ZIP archive first, an attacker can crash the ClamAV scanning service. Subsequent malicious payloads—such as ransomware, credential stealers, or backdoors—can then drop onto the disk and execute without being scanned or flagged by local signatures.
2. Elevated Privilege Execution on Windows: The security impact is particularly acute on Windows installations. On Windows endpoints, the Cisco Secure Endpoint Connector runs the ClamAV scanning process inside a high-privilege system context (SYSTEM). Causing an abrupt crash of a process running with system-level privileges destabilizes the endpoint security stack and can crash dependent operating system components.

Cisco PSIRT confirmed that proof-of-concept exploit code is publicly available for both CVE-2026-20337 and CVE-2026-20338. While there is no current evidence indicating active exploitation in live attacks, the public release of functional PoCs significantly narrows the window before threat actors incorporate these archive crash payloads into automated attack toolkits.

Affected Versions and Patch Status

The vulnerabilities affect ClamAV versions 1.5.0 through 1.5.3, as well as enterprise software that embeds the ClamAV engine.

• Standalone ClamAV: Upstream patches were released on August 7 in ClamAV version 1.5.4. Organizations running open-source ClamAV deployments on Linux, Unix, or Windows servers should upgrade directly to 1.5.4 or later.
• Cisco Secure Endpoint Connector: Cisco’s commercial endpoint agent (for Windows, Linux, and macOS) integrates ClamAV for local file inspection. Cisco confirmed that no workarounds exist for these vulnerabilities and plans to release updated Secure Endpoint Connector software packages later this month.

These ZIP parser fixes accompany recent patches addressing five additional ClamAV DoS security flaws involving malformed XAR, Mach-O, PDF, GPT, and PESpin file parsers.

Remediation Guidance

System administrators and enterprise security personnel should execute the following targeted actions:

1. Upgrade Open-Source Engines Immediately: Upgrade all standalone ClamAV installations (including mail gateway attachments filters and containerized scanners) to ClamAV 1.5.4.
2. Prepare Cisco Secure Endpoint Agent Deployment: Monitor Cisco’s Software Central for the upcoming Secure Endpoint Connector maintenance updates for Windows, Linux, and macOS, and schedule immediate rollout across enterprise endpoints upon release.
3. Configure Service Crash Alerts: Configure endpoint detection (EDR) rules or system monitoring tools to trigger alerts whenever the clamd process or Cisco Secure Endpoint Connector service terminates unexpectedly, treating rapid service crashes as potential indicators of an evasion attempt.