CVE-2026-20348
HIGH 7.5 ALL-YEARSA vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.7%chance of exploitation in 30 days · 54th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH · CNA
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Cisco | Secure Endpoint | < 1.27.4 |
| Cisco | Secure Endpoint | < 1.29.2 |
| Cisco | Secure Endpoint | < 7.5.24.21780 |
| Cisco | Secure Endpoint | ≥ 8.0.0 and < 8.6.3 |
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 CVE record · cisco · Updated 2026-08-07T16:42:51.411Z
NVD · CVE-2026-20348 · Updated 2026-10-23T20:10:00.160 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54508 EUVD · EUVD-2026-54508
Sources: NVD · CVE.org · All sources and attribution · EPSS