CVE-2026-20215

Analyzed Analyzed - Analysis Complete

Memory Corruption in ClamAV 7z Parser

Publication date: 2026-07-01

Last updated on: 2026-07-09

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-09

Generated

2026-07-22

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-20215

EUVD

EUVD-2026-41083

Affected Vendors & Products

Vendor	Product	Version / Range
clamav	clamav	to 1.4.5 (exc)
clamav	clamav	From 1.5.0 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the 7z file format parser of ClamAV. It occurs because the software does not properly check boundaries when scanning 7z files, which can lead to writing data outside the intended memory area (out-of-bounds buffer write).

An attacker can exploit this by submitting a specially crafted 7z file to be scanned by ClamAV. This can cause the scanning process to crash or terminate unexpectedly.

Impact Analysis

Exploiting this vulnerability can cause a denial-of-service (DoS) condition by terminating the ClamAV scanning process. This means that the antivirus scanning service could stop working, potentially leaving the system unprotected against malware.

There may also be other expanded impacts due to memory corruption, but the primary known impact is the DoS condition.

Compliance Impact

The provided information does not specify how this vulnerability in the ClamAV 7z file format parser affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade ClamAV to the fixed versions provided by Cisco. Specifically, upgrade Secure Endpoint Connector for Windows to version 8.6.2, for Linux to version 1.29.0, and for Mac to version 1.27.2.

No workarounds are available, so applying the software updates is the immediate and recommended step to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-20215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70