Cisco has issued a warning regarding seven vulnerabilities discovered in the ClamAV antivirus engine, which affect its Secure Endpoint Connector products for Windows, macOS, and Linux. Two of these flaws have publicly available proof-of-concept exploits that could allow unauthenticated attackers to trigger denial-of-service conditions, according to a recent report by Security Affairs.
The vulnerabilities, identified as CVE-2026-20337 through CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, impact ClamAV's parsers for various file formats. Specifically, CVE-2026-20337 and CVE-2026-20338, both with a CVSS score of 7.5, relate to vulnerabilities in the zip archive parser.
These could allow remote attackers to cause out-of-bounds writes or memory corruption, leading to the termination of ClamAV scanning operations. Cisco has stated that while there is no evidence of these vulnerabilities being exploited in the wild, patches are expected in August. The risk is considered high for Windows due to ClamAV running with elevated privileges, while macOS and Linux face a medium risk. No workarounds are currently available for these issues.
Source: Security Affairs
Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.
Kelley Damore is Chief Content Officer at CyberRisk Alliance, where she leads content strategy across the company’s digital brands, research, communities and live events serving CISOs and security practitioners. At CyberRisk Alliance, she is focused on delivering 365-day engagement, trusted journalism and actionable insights to help security leaders navigate an increasingly complex threat landscape.
An error occurred trying to play the stream. Please reload the page and try again.
CloseRegistering with SC Media is 100% free. Join tens of thousands of cybersecurity leaders today and gain access to the latest analysis shaping the global infosec agenda.
