--- title: Cisco warns of high-severity ClamAV flaws with public... description: Cisco has disclosed two high-severity vulnerabilities (CVE-2026-20337 and CVE-2026-20338) in ClamAV's ZIP archive parser, affecting versions 1.5.0 through... canonical: https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco warns of high-severity ClamAV flaws with public exploits | daily.dev og:description: Cisco has disclosed two high-severity vulnerabilities (CVE-2026-20337 and CVE-2026-20338) in ClamAV's ZIP archive parser, affecting versions 1.5.0 through... og:url: https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt og:image: https://api.daily.dev/og/posts/waf9CxMQt.png og:image:alt: Cisco warns of high-severity ClamAV flaws with public exploits og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco warns of high-severity ClamAV flaws with public exploits **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary Cisco has disclosed two high-severity vulnerabilities (CVE-2026-20337 and CVE-2026-20338) in ClamAV's ZIP archive parser, affecting versions 1.5.0 through 1.5.3. Both flaws allow unauthenticated remote attackers to crash the ClamAV scanning process via crafted ZIP files, causing denial-of-service conditions. The security impact is rated high specifically on Windows, where ClamAV runs in a privileged context. Public proof-of-concept exploit code exists, though no in-the-wild exploitation has been confirmed. ClamAV 1.5.4, released August 7, patches both CVEs. Cisco also patched five additional ClamAV DoS flaws on the same day affecting XAR, Mach-O, PDF, GPT, and PESpin file parsers. Software updates for Secure Endpoint Connector on Windows, Linux, and Mac are planned for later in the month. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are CVE-2026-20337 and CVE-2026-20338 and how do they affect ClamAV? They are two high-severity vulnerabilities in the ZIP archive parser of ClamAV versions 1.5.0 through 1.5.3, caused by improper boundary checks and memory handling. An unauthenticated remote attacker can submit a crafted ZIP file for scanning to crash the ClamAV scanning process, causing a denial-of-service condition. Public proof-of-concept exploit code is available, though no in-the-wild exploitation has been confirmed. _Teams running ClamAV in production can track vulnerability disclosures like these on daily.dev before patching windows close._ ### Which ClamAV version fixes the CVE-2026-20337 and CVE-2026-20338 denial-of-service flaws? ClamAV version 1.5.4, released August 7, patches both vulnerabilities. Affected versions were 1.5.0 through 1.5.3, and there are currently no workarounds available for systems that cannot yet upgrade, so updating to 1.5.4 is the only mitigation. _Developers tracking ClamAV patch versions can follow security updates like this one on daily.dev._ ### Why does Cisco consider the ClamAV DoS vulnerabilities high severity only on Windows? Cisco rates the security impact as high specifically for Windows platforms because Windows is the only operating system where the ClamAV scanning process runs in a privileged security context. On Linux and Mac, the same ZIP parser flaws exist but carry lower severity since the scanning process does not run with elevated privileges. _Admins weighing platform-specific patch priorities can check severity breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [The “Unzip” of Death: Why Using Your Old WinRAR Is a Dangerous Trap](https://daily.dev/posts/the-unzip-of-death-why-using-your-old-winrar-is-a-dangerous-trap-bwbzk88fe) · InfoSec Write-ups · 0 upvotes · 0 comments - [Ransomware scum, other crims exploit 4 old Microsoft bugs](https://daily.dev/posts/ransomware-scum-other-crims-exploit-4-old-microsoft-bugs-ez6lhkszs) · The Register · 0 upvotes · 0 comments - [Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability \(CVE-2025-11001\)](https://daily.dev/posts/hackers-actively-exploiting-7-zip-symbolic-link-based-rce-vulnerability-cve-2025-11001--hzcl4jrdf) · The Hacker News · 0 upvotes · 0 comments - [Microsoft warns of new Defender zero-days exploited in attacks](https://daily.dev/posts/microsoft-warns-of-new-defender-zero-days-exploited-in-attacks-0yj5px1ug) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#cisco](https://daily.dev/tags/cisco) [View this post on daily.dev](https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco warns of high-severity ClamAV flaws with public exploits","url":"https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt"},"datePublished":"2026-08-11T11:07:33.077Z","dateModified":"2026-09-13T20:08:36.646Z","description":"Cisco has disclosed two high-severity vulnerabilities (CVE-2026-20337 and CVE-2026-20338) in ClamAV's ZIP archive parser, affecting versions 1.5.0 through...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05d254b20ea6b2f652801726a23af55d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05d254b20ea6b2f652801726a23af55d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,vulnerability,cisco","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Cisco warns of high-severity ClamAV flaws with public exploits"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-warns-of-high-severity-clamav-flaws-with-public-exploits-waf9cxmqt#faq","mainEntity":[{"@type":"Question","name":"What are CVE-2026-20337 and CVE-2026-20338 and how do they affect ClamAV?","acceptedAnswer":{"@type":"Answer","text":"They are two high-severity vulnerabilities in the ZIP archive parser of ClamAV versions 1.5.0 through 1.5.3, caused by improper boundary checks and memory handling. An unauthenticated remote attacker can submit a crafted ZIP file for scanning to crash the ClamAV scanning process, causing a denial-of-service condition. Public proof-of-concept exploit code is available, though no in-the-wild exploitation has been confirmed. Teams running ClamAV in production can track vulnerability disclosures like these on daily.dev before patching windows close."}},{"@type":"Question","name":"Which ClamAV version fixes the CVE-2026-20337 and CVE-2026-20338 denial-of-service flaws?","acceptedAnswer":{"@type":"Answer","text":"ClamAV version 1.5.4, released August 7, patches both vulnerabilities. Affected versions were 1.5.0 through 1.5.3, and there are currently no workarounds available for systems that cannot yet upgrade, so updating to 1.5.4 is the only mitigation. Developers tracking ClamAV patch versions can follow security updates like this one on daily.dev."}},{"@type":"Question","name":"Why does Cisco consider the ClamAV DoS vulnerabilities high severity only on Windows?","acceptedAnswer":{"@type":"Answer","text":"Cisco rates the security impact as high specifically for Windows platforms because Windows is the only operating system where the ClamAV scanning process runs in a privileged security context. On Linux and Mac, the same ZIP parser flaws exist but carry lower severity since the scanning process does not run with elevated privileges. Admins weighing platform-specific patch priorities can check severity breakdowns like this on daily.dev."}}]} ```