CVE-2026-20347
Received Received - Intake

Memory Corruption in ClamAV Mach-O Parser

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted Mach-O file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-20347
EUVD
EUVD-2026-54532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
clamav clamav *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Mach-O file format parser of ClamAV. It allows an unauthenticated remote attacker to cause a denial of service (DoS) or other impacts by exploiting improper boundary checks during scanning. The issue leads to an out-of-bounds buffer read, which can terminate the ClamAV scanning process.

Detection Guidance

Detect this vulnerability by checking if ClamAV is installed and running on your system. Use commands like 'clamd --version' to verify the version and 'ps aux | grep clamd' to check if the ClamAV daemon is active. Monitor logs for crashes or errors during Mach-O file scanning.

Impact Analysis

An attacker could submit a specially crafted Mach-O file to be scanned by ClamAV. If exploited, this could cause the ClamAV scanning process to crash, leading to a DoS condition on the affected device. This disrupts normal operations and may require manual intervention to restore service.

Compliance Impact

This vulnerability could impact compliance by causing disruptions in security scanning processes, potentially leading to unscanned files or delayed threat detection. However, the provided text does not specify direct impacts on GDPR or HIPAA compliance.

Mitigation Strategies

Update ClamAV to the latest version to patch the vulnerability. Disable automatic scanning of Mach-O files if not required. Implement network-level controls to block suspicious Mach-O file uploads. Monitor ClamAV logs for unusual activity or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart