CVE-2026-20216: 
Clam AntiVirus vulnerability analysis and mitigation

CVE-2026-20216 is a Denial of Service (DoS) vulnerability in the InstallShield file format parser of ClamAV, allowing an unauthenticated remote attacker to terminate the ClamAV scanning process and temporarily exhaust system resources. It was disclosed on July 1, 2026, as part of a broader Cisco security advisory covering seven ClamAV vulnerabilities. Affected software includes ClamAV versions prior to 1.4.5 and 1.5.0–1.5.2 (fixed in 1.5.3), as well as Cisco Secure Endpoint Connector for Linux (before 1.29.0), Mac (before 1.27.2), and Windows (before 8.6.2). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Cisco Advisory, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), specifically improper handling of temporary resources during InstallShield file scanning. An unauthenticated attacker can exploit this by submitting a specially crafted InstallShield file to any ClamAV-enabled scanning endpoint — no authentication, user interaction, or special privileges are required. The malformed file triggers uncontrolled resource consumption within the parser, causing the ClamAV scanning process to terminate. The vulnerability is network-accessible with low attack complexity, making it straightforward to exploit remotely. The researcher credited with discovering this specific vulnerability is "Mizu" (Cisco Advisory).

Successful exploitation results in termination of the ClamAV scanning process and temporary consumption of available system resources, causing a DoS condition on the affected software. On Windows-based platforms running Cisco Secure Endpoint Connector, the scanning engine runs in a privileged security context, meaning the endpoint may become unresponsive and require manual intervention (e.g., a system reboot) to recover — elevating the Security Impact Rating to High for those platforms. On Linux and Mac platforms, the scanning process runs in a lower-privileged context, so overall system stability is not affected, though scanning operations are delayed or prevented. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern (Cisco Advisory).

No public proof-of-concept exploit code is known to exist, and Cisco PSIRT has confirmed no public announcements or malicious use of this vulnerability at the time of disclosure (Cisco Advisory). The EPSS score is approximately 0.389%, indicating a low near-term probability of exploitation in the wild (GitHub Advisory). The vulnerability is marked as automatable (no user interaction required) with network-level access, which lowers the barrier for exploitation if a PoC were to emerge. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify systems running ClamAV (versions < 1.4.5 or 1.5.0–1.5.2) or Cisco Secure Endpoint Connector (Linux < 1.29.0, Mac < 1.27.2, Windows < 8.6.2) that accept file submissions for scanning, such as mail gateways, web upload endpoints, or network shares monitored by ClamAV.
2. Craft malicious InstallShield file: Create a specially malformed InstallShield installer file designed to trigger improper temporary resource allocation within ClamAV's InstallShield parser. The file must be structured to cause unbounded resource consumption during parsing.
3. Submit file for scanning: Deliver the crafted file to the target system through any channel that triggers ClamAV scanning — e.g., email attachment, web file upload, or placing the file in a monitored directory.
4. Trigger DoS: ClamAV's InstallShield parser processes the malformed file, fails to properly limit temporary resource allocation, and terminates the scanning process. On Windows-based Cisco Secure Endpoint, this may render the endpoint unresponsive, requiring a reboot (Cisco Advisory).

• Logs: Unexpected ClamAV process termination entries in system logs (e.g., clamd crash or exit in /var/log/clamav/clamav.log); repeated scanning failures or timeouts logged around the same time.
• Process: Absence of the clamd or clamscan process when it should be running; unexpected respawn events for the ClamAV daemon.
• File System: Presence of unusual or oversized InstallShield (.exe or .cab) files in directories monitored by ClamAV, particularly files with malformed headers.
• Network: Repeated submission of InstallShield-format files from a single external source to a mail gateway or web upload endpoint; unusual spikes in file scanning queue depth followed by scanner unavailability.
• System: High temporary resource (disk/memory) usage spikes coinciding with ClamAV process crashes on Windows endpoints; endpoints requiring unexpected reboots to restore Cisco Secure Endpoint functionality.

Cisco has released fixed versions to address this vulnerability: ClamAV 1.4.5 and 1.5.3, Cisco Secure Endpoint Connector for Linux 1.29.0, for Mac 1.27.2, and for Windows 8.6.2. Cisco Secure Endpoint Private Cloud is not directly impacted, but connector updates are distributed through the connector repository and applied via normal content update processes. There are no workarounds available — upgrading to a fixed release is the only remediation. As an interim measure, organizations should apply network segmentation to limit which systems can submit files for ClamAV scanning, and monitor ClamAV process stability for unexpected terminations (Cisco Advisory, GitHub Advisory).

The vulnerability was part of a broader July 2026 ClamAV security patch release (versions 1.5.3 and 1.4.5) that addressed seven legacy vulnerabilities, receiving coverage from security news outlets including Help Net Security, Linuxiac, and VPN Central (Help Net Security, Linuxiac). The ClamAV blog published an official announcement of the patch releases (ClamAV Blog). The Hacker News included the vulnerability in its weekly security recap, indicating moderate community awareness. Cisco PSIRT noted that several of the co-disclosed vulnerabilities were discovered through AI-assisted research tools, which drew some industry attention to the role of automated vulnerability discovery.