CVE-2026-20338
Received Received - Intake

Denial of Service in ClamAV Zip Archive Parser

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-20338
EUVD
EUVD-2026-54529

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cisco secure_endpoint_connector *
clamav clamav *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service (DoS) vulnerability in ClamAV's zip archive parser. It occurs when the software mishandles memory while scanning contents of zip files. An attacker can exploit this by sending a specially crafted zip file, causing the scanning process to crash due to a memory double-free error, leading to a DoS condition on the affected system.

Detection Guidance

Detect this vulnerability by checking the version of ClamAV installed on your system. Use the command 'clamav --version' to verify if your version is affected. Monitor for crashes during zip file scanning, which may indicate exploitation.

Impact Analysis

If you use ClamAV for malware scanning, an attacker could send a malicious zip file to trigger this flaw. This would crash the ClamAV scanning process, potentially disrupting security scans and leaving your system vulnerable to other threats. It does not allow data theft or code execution, only service interruption.

Compliance Impact

This DoS vulnerability could impact compliance by disrupting security monitoring required under standards like GDPR (data protection) or HIPAA (health data). A DoS condition may prevent timely threat detection, potentially violating obligations to maintain security controls and protect sensitive data.

Mitigation Strategies

Update ClamAV to the latest version immediately to patch this vulnerability. Disable automatic scanning of zip files if possible until patched. Ensure your ClamAV signatures are updated regularly to detect malicious zip files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart