CVE-2026-20348
Received Received - Intake

Memory Corruption in ClamAV XAR Parser

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-20348
EUVD
EUVD-2026-54508

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
clamav clamav *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the XAR file format parser of ClamAV. It allows an unauthenticated remote attacker to cause a denial of service (DoS) or other impacts by exploiting improper boundary checks during scanning of crafted XAR files.

Detection Guidance

Detecting this vulnerability requires monitoring ClamAV scanning processes and analyzing XAR files for malformed content. Check ClamAV logs for crashes or errors during scanning. Use ClamAV's clamscan command with verbose mode to inspect XAR files: clamscan -v --debug /path/to/file.xar. Enable ClamAV's debug logging in clamd.conf to capture detailed parsing errors.

Impact Analysis

An attacker could submit a malicious XAR file to be scanned by ClamAV, causing the scanning process to crash. This results in a DoS condition, disrupting the antivirus service on the affected device.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by disrupting the availability of ClamAV scanning services. A DoS condition may prevent proper scanning of files, potentially leading to undetected malware or unauthorized data access, which could violate data protection requirements.

Mitigation Strategies

Update ClamAV to the latest version to patch the XAR file parser vulnerability. Monitor network traffic for suspicious file submissions and disable XAR file scanning temporarily if possible until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20348. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart