A vulnerability in the zip archive parser of ClamAV could

CVE-2026-20337 is a heap out-of-bounds write in ClamAV's ZIP archive parser caused by incorrect catalogue capacity tracking when indexing local file headers. A crafted ZIP file submitted for scanning — via email attachment, file upload endpoint, or any path that feeds clamd — crashes the ClamAV process. Affected versions are ClamAV 1.5.0 through 1.5.3; the fix ships in 1.5.4 (released 2026-08-07). The bug also affects Cisco Secure Endpoint connectors for Windows (scored HIGH 7.5), Linux, and macOS (scored MEDIUM 5.3). PoC code is publicly available. The researcher is Kevin Stubbings of GitHub Security Lab.

Cisco's HIGH / 7.5 rating is directionally correct but slightly generous for most deployments. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects unauthenticated network-reachable denial of service — no confidentiality or integrity impact, no code execution. That matters: crashing clamd is recoverable (the process restarts or the watchdog respawns it), and the blast radius is availability of the scanning function, not host compromise. However, ClamAV's role as a security-plane component on mail gateways means a crash can be weaponized as a two-stage attack: crash the scanner, then deliver the real payload unscanned. That security-degradation angle justifies staying at HIGH rather than dropping to MEDIUM.

Why this verdict

• DoS-only impact caps severity below CRITICAL. The CVSS vector explicitly scores C:N/I:N — there is no path to code execution, data exfiltration, or integrity compromise from this bug alone. A crash is recoverable.
• Role multiplier: ClamAV is a security-plane component. On mail gateways (Amavis, MailScanner, rspamd) and Cisco Secure Endpoint hosts, ClamAV is the AV scanning engine. Crashing it degrades the organization's malware detection. On mail gateways specifically (a high-value role representing a large share of ClamAV deployments), a sustained crash opens a window to deliver unscanned malware — blast radius extends from 'scanner availability' to 'security posture of all protected hosts'. This floors the verdict at HIGH.
• PoC is public, attack is trivial, no auth required. The attack requires only sending an email or uploading a file — the lowest friction delivery mechanism in enterprise environments. This prevents any downgrade below HIGH.
• Watchdog restart limits the window. Most production clamd deployments auto-restart within seconds via systemd or equivalent, narrowing the blind window. This friction prevents an upgrade to CRITICAL despite the security-agent role.

Why not higher?

The impact is strictly availability — no confidentiality or integrity loss, no code execution, no privilege escalation. ClamAV crashes are recoverable, and the blind-the-scanner window is narrow on well-configured systems with watchdog restarts. Dual-engine or cloud-sandbox mail architectures further reduce the blast radius. Without RCE, the security-agent role alone does not justify CRITICAL.

Why not lower?

ClamAV processes untrusted input from the network with zero authentication and zero user interaction — the most favorable attacker economics possible. The PoC is public. The security-agent role means DoS here is not just 'service unavailable' but 'detection capability degraded', which has downstream impact on the entire mail flow. Dropping to MEDIUM would ignore the security-plane blast radius.

1. Enable clamd watchdog restart with aggressive respawn — Ensure clamd runs under systemd with Restart=always and RestartSec=1 (or equivalent supervisor). This shrinks the blind window to ~1-2 seconds per crash. Deploy within the noisgate mitigation SLA of 30 days, though this should already be in place on production systems.
2. Deploy dual-engine or cloud-sandbox scanning on the mail path — Run a second AV engine (e.g., Sophos, ESET) or cloud sandbox (e.g., Cisco Secure Malware Analytics, Palo Wildfire) in the mail pipeline so a ClamAV crash does not leave inbound mail completely unscanned. This is the strongest compensating control against the blind-the-scanner pattern.
3. Rate-limit inbound email from single senders — Throttle messages per sender to make sustained crash-restart cycling impractical. Most MTAs (Postfix smtpd_client_message_rate_limit, Exchange throttling policies) support this natively.
4. Monitor clamd crash/restart frequency via SIEM — Alert on repeated clamd process restarts (>2 in 5 minutes). Correlate with inbound mail volume gaps. This turns the attack into a detectable event. Deploy within 30 days per noisgate mitigation SLA.

Run on each host running ClamAV (mail gateway, file scanner, endpoint). Execute as any user with read access to clamd or clamscan. Example: bash check_cve_2026_20337.sh

#!/usr/bin/env bash
# CVE-2026-20337 checker — ClamAV ZIP heap OOB write
# Affected: 1.5.0 – 1.5.3 | Fixed: 1.5.4+
set -euo pipefail

get_version() {
  local bin
  for bin in clamscan clamd; do
    if command -v "$bin" &>/dev/null; then
      "$bin" --version 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1
      return
    fi
  done
  echo ""
}

VER=$(get_version)
if [[ -z "$VER" ]]; then
  echo "UNKNOWN — ClamAV not found on this host."
  exit 2
fi

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

echo "Detected ClamAV version: $VER"

# Affected: 1.5.0 – 1.5.3
if [[ "$MAJOR" -eq 1 && "$MINOR" -eq 5 && "$PATCH" -le 3 ]]; then
  echo "VULNERABLE — ClamAV $VER is in the affected range (1.5.0–1.5.3). Update to 1.5.4+."
  exit 1
elif [[ "$MAJOR" -eq 1 && "$MINOR" -eq 5 && "$PATCH" -ge 4 ]]; then
  echo "PATCHED — ClamAV $VER includes the fix."
  exit 0
elif [[ "$MAJOR" -gt 1 || ("$MAJOR" -eq 1 && "$MINOR" -gt 5) ]]; then
  echo "PATCHED — ClamAV $VER is newer than the affected range."
  exit 0
else
  echo "PATCHED — ClamAV $VER predates the affected 1.5.x branch."
  exit 0
fi

Sources

1. Cisco Security Advisory — ClamAV August 2026
2. ClamAV 1.5.4 Release Notes (GitHub)
3. Linuxiac — ClamAV 1.5.4 Fixes Eight Vulnerabilities
4. MalwareTips Forum — ClamAV 1.5.4 Discussion
5. ClamAV Official Blog
6. CERT/CC — ZIP Archive Scanning Advisory (context)