CVE-2026-20348: ClamAV XAR File Format Processing Memory Corruption Vulnerability
Cisco · Cisco Secure Endpoint
No fix listed · Affected: Cisco Secure Endpoint · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 54% of scored CVEs
DescriptionNVD
A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Cisco
- Published
- August 2026
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityWeek, 10 Aug.
- Mon 10 Aug, 14:41 UTC. SecurityWeek, first report. Cisco flags ClamAV bugs in Secure Endpoint Connector, risking DoS.
- Tue 11 Aug, 16:32 UTC. Security Affairs, its first report on the story. Cisco Warns of Critical ClamAV Flaws Affecting Secure Endpoint.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 10 Aug 14:41 | SecurityWeek | Cisco flags ClamAV bugs in Secure Endpoint Connector, risking DoS |
| 11 Aug 16:32 | Security Affairs | Cisco Warns of Critical ClamAV Flaws Affecting Secure Endpoint |
- Cisco Warns of Critical ClamAV Flaws Affecting Secure EndpointSecurity Affairs · mentions it in passing
- Cisco flags ClamAV bugs in Secure Endpoint Connector, risking DoSSecurityWeek · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.