CVE-2026-20243: 
Clam AntiVirus vulnerability analysis and mitigation

CVE-2026-20243 is a memory corruption vulnerability in the ALZ file format parser of ClamAV, classified as "ClamAV ALZ File Format Processing Memory Corruption Vulnerability." It allows an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition — and possibly other expanded impacts — by submitting a crafted ALZ file for scanning. Affected software includes ClamAV versions 1.4.0–1.4.4 and 1.5.0–1.5.2, as well as Cisco Secure Endpoint Connector for Windows (before 8.6.2), Linux (before 1.29.0), and macOS (before 1.27.2). The vulnerability was publicly disclosed on July 1, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Cisco Advisory, GitHub Advisory).

The root cause is improper boundary checking during ALZ file content parsing in ClamAV's scanning engine, classified as CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow). When ClamAV processes a maliciously crafted ALZ archive, the parser fails to validate that input content fits within the allocated output buffer, resulting in an out-of-bounds buffer write and subsequent memory corruption. The attack vector is network-based, requires no authentication or user interaction, and is triggered simply by submitting a crafted file to any ClamAV-enabled scanning service. On Windows platforms running Cisco Secure Endpoint Connector, the scanning process runs in a privileged security context, increasing the potential impact; on Linux and macOS, the process runs with lower privileges. CVE-2026-20243 is one of seven related memory corruption vulnerabilities disclosed in the same Cisco advisory (cisco-sa-clamav-88cFYyxR), all sharing the same attack pattern across different file format parsers (Cisco Advisory, Red Hat Bugzilla).

Successful exploitation causes the ClamAV scanning process to terminate, resulting in a DoS condition that interrupts all scanning operations on the affected device. On Cisco Secure Endpoint Connector for Windows, where the scanning engine runs in a privileged context, exploitation may render the endpoint unresponsive and require manual intervention such as a system reboot to recover; on Linux and macOS, the impact is limited to scanning service disruption without broader system instability. While the primary confirmed impact is availability loss (no confidentiality or integrity impact), Cisco notes that on Windows platforms, similar memory corruption vulnerabilities have historically been leveraged for remote code execution, though no evidence of RCE potential has been confirmed for this specific vulnerability. Legacy 32-bit Windows systems are at higher risk (Cisco Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The Cisco PSIRT has confirmed it is not aware of any public announcements or malicious use of this vulnerability. The EPSS score is approximately 0.389%, indicating a low near-term probability of exploitation. The vulnerability is automatable (no user interaction required) and exploitable by unauthenticated remote attackers, but its technical impact is rated "partial" by NVD SSVC. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by multiple independent researchers including Yazdan Soltani, pawlok and barteq of the GetResponse Security Team, and leduckhuong (Cisco Advisory, GitHub Advisory).

1. Reconnaissance: Identify systems running vulnerable ClamAV versions (1.4.0–1.4.4 or 1.5.0–1.5.2) or Cisco Secure Endpoint Connector (Windows < 8.6.2, Linux < 1.29.0, macOS < 1.27.2) that accept file submissions for scanning, such as email gateways, web upload scanners, or endpoint protection services.
2. Craft malicious ALZ file: Create a specially crafted ALZ archive file with malformed content that violates boundary checks in ClamAV's ALZ parser — specifically, content sized to trigger an out-of-bounds buffer write when copied to the output buffer.
3. Submit file for scanning: Deliver the crafted ALZ file to the target ClamAV scanning service via any available channel — email attachment, web file upload, network share scan, or direct API submission to a ClamAV daemon (e.g., clamd via TCP socket on port 3310).
4. Trigger memory corruption: ClamAV's ALZ parser processes the file without adequate boundary validation, causing an out-of-bounds write that corrupts memory and crashes the scanning process.
5. Achieve DoS: The ClamAV scanning process terminates, halting all scanning operations. On Windows-based Cisco Secure Endpoint, the endpoint may become unresponsive, requiring a manual reboot to restore functionality (Cisco Advisory).

• Logs: Unexpected ClamAV process crash logs or core dump files; clamd service termination events in system logs (e.g., /var/log/syslog, Windows Event Log); repeated scanning service restarts in a short timeframe.
• File System: Presence of core dump files (e.g., core, clamd.core) in ClamAV working directories; unexpected .alz files in scan queues or temporary directories.
• Network: Unusual or repeated submissions of ALZ-format files to ClamAV scanning endpoints (e.g., repeated connections to clamd TCP port 3310 with ALZ content); high-volume file submission attempts from a single source IP.
• Process: Sudden termination of the clamd or ClamAV scanning process; on Windows Cisco Secure Endpoint, the sfc.exe or endpoint connector process becoming unresponsive or requiring restart.

Cisco has released fixed versions addressing this vulnerability: Cisco Secure Endpoint Connector for Windows 8.6.2, for Linux 1.29.0, and for macOS 1.27.2. For standalone ClamAV, patched versions are 1.4.5 and 1.5.3. Cisco notes there are no workarounds available — upgrading to a fixed release is the only remediation. Cisco Secure Endpoint Connector may update automatically depending on configured policy; otherwise, updates are available through the Cisco Secure Endpoint portal. As an interim operational measure, organizations can implement network-level controls to restrict or monitor file submissions to ClamAV scanning services, or consider disabling ALZ file format scanning if not operationally required (Cisco Advisory).

The vulnerability was covered by security news outlets including Help Net Security, VPN Central, and Linuxiac, which noted it as part of a broader set of seven ClamAV security patches addressing legacy vulnerabilities. The ClamAV blog published a dedicated post announcing the 1.5.3 and 1.4.5 security patch releases. Linux distribution maintainers including Ubuntu (USN-8517-1), SUSE (SUSE-SU-2026:2835-1), and openSUSE issued security advisories and updated packages promptly. The Hacker News included the vulnerability in its weekly security recap. Community reaction was generally measured, noting the lack of active exploitation and the availability of patches, with particular attention to the elevated risk on Windows platforms running Cisco Secure Endpoint (Cisco Advisory).