Cisco has revealed multiple high-severity vulnerabilities in ClamAV that could disrupt antivirus scans and cause denial-of-service conditions This article explores severity vulnerabilities clamav. . The advisory, identified as cisco-sa-clamav-WuuvVd26, was first disclosed on August 7, 2026, with an update on August 10.
Cisco assigned a High security impact rating to affected Windows systems, while Linux and macOS environments were rated Medium. The company attributed the difference in ratings to the privileged security context utilized by ClamAV scanning processes on Windows devices.
Multiple ClamAV Vulnerabilities The vulnerabilities include: - Out-of-Bounds Write Vulnerability: CVE-2026-20337 - Heap Buffer Overflow: CVE-2026-20338 - Memory Corruption: CVE-2026-20339 - Dereferencing Pointer to Executable Data: CVE-2026-20345 - Remote Code Execution: CVE-2026-20346 - Denial of Service via Malware Detection Failure: CVE-2026-20347 - Unpatched ClamAV Version: CVE-2026-20348 These vulnerabilities carry a CVSS score of 7.5 and can be exploited remotely without authentication or user interaction. Here are the specific vulnerabilities: - **ZIP Parser Out-of-Bounds Write DoS/Crash** - This vulnerability involves an entity responsible for parsing ZIP files, which may result in a denial of service attack and crash. - **PESpin Parser Integer Overflow DoS/Memory Corruption** - This vulnerability targets an entity processing PESpin files, potentially leading to a denial of service attack and memory corruption.
Private Cloud customers should ensure they are running version 4.2.8 or later to receive updated connector software via normal content update processes.
