Multiple ClamAV Flaws Let Remote Attackers Cause DoS

TL;DR

Cisco disclosed seven ClamAV vulnerabilities on August 7, 2026. Each lets an unauthenticated remote attacker crash the scanner with a crafted file. The result is a denial of service that stops malware scanning. The technical details are now public, but no exploitation in the wild has been confirmed. Patches are on the way.

Notable CVEs

Why This Matters

ClamAV is a widely deployed open-source antivirus engine. It also ships inside Cisco Secure Endpoint connectors. A single ClamAV vulnerability can therefore disable scanning across many systems. As Cisco states, these flaws “could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations.”

On Windows, the impact rises. Cisco notes those platforms “run the ClamAV scanning process in a privileged security context.” As a result, Cisco rates the Security Impact as High for Windows-based products such as the Secure Endpoint Connector for Windows.

How the Attack Works

Every issue lives in a file-format parser. The bugs cover ZIP, PESpin, GPT, PDF, Mach-O, and XAR handling. Most involve out-of-bounds writes or memory corruption during scanning.

The attack path is simple. An attacker submits a crafted file for scanning. Improper boundary checks then trigger a crash. Consequently, the ClamAV scanning process terminates and reloads. The flaws are independent, so one does not depend on another.

Affected Versions

The vulnerabilities affect ClamAV releases before the 1.5.4 and 1.4.6 security patches. Cisco Secure Endpoint connectors for Windows, Linux, and Mac are also affected. All seven CVEs carry a CVSS score of 7.5.

Patch and Mitigation

No workarounds exist. Cisco is clear: “There are no workarounds that address these vulnerabilities.” Therefore, upgrading is the only fix. Cisco “strongly recommends that customers upgrade to the fixed software.” Update ClamAV to a patched build and apply Cisco connector updates as they ship. For full details, review the official Cisco security advisory.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.