CVE-2026-20217

Analyzed Analyzed - Analysis Complete

DoS via Memory Corruption in ClamAV PESpin Parser

Publication date: 2026-07-01

Last updated on: 2026-07-09

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-09

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-20217

EUVD

EUVD-2026-41082

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	secure_endpoint	to 1.29.0 (exc)
cisco	secure_endpoint	to 8.6.2 (exc)
cisco	secure_endpoint	to 1.27.2 (exc)
clamav	clamav	to 1.4.5 (exc)
clamav	clamav	From 1.5.0 (inc) to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the PESpin file format parser of ClamAV. It occurs because the software does not properly check boundaries when processing PESpin files, which can lead to writing data outside the intended memory area (out-of-bounds buffer write).

An attacker can exploit this by submitting a specially crafted PESpin file to be scanned by ClamAV. This can cause the scanning process to crash or terminate unexpectedly.

Detection Guidance

There are no specific detection commands or network/system detection methods provided for this vulnerability in the available resources.

Impact Analysis

Exploiting this vulnerability can cause a denial-of-service (DoS) condition by terminating the ClamAV scanning process. This means that the antivirus software may stop functioning properly, potentially leaving the system unprotected against malware.

There may also be other expanded impacts due to memory corruption, but the primary known impact is the DoS condition.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade to the fixed versions of the affected software.

Upgrade Cisco Secure Endpoint Connector for Windows to version 8.6.2.
Upgrade Cisco Secure Endpoint Connector for Linux to version 1.29.0.
Upgrade Cisco Secure Endpoint Connector for Mac to version 1.27.2.

No workarounds are available, so applying these updates is the recommended immediate action.

Hi! I’m here to help you understand CVE-2026-20217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70