CVE-2026-20214: ClamAV FSG Parser Out-of-Bounds Write DoS

Technical summary

CVE-2026-20214 stems from inadequate boundary validation in ClamAV's FSG file format parser. The vulnerability manifests as an out-of-bounds buffer write (CWE-120) when processing portable executable content compressed with FSG compression. The flaw allows remote unauthenticated attackers to submit crafted files that corrupt memory in the scanning process, leading to process termination. The CVSS 3.1 score of 7.5 (HIGH) reflects the high availability impact and low attack complexity, though confidentiality and integrity are not directly affected by this specific flaw path.

Business impact

Organizations relying on ClamAV for email gateway scanning, file server protection, or endpoint defense face potential service disruptions. Successful exploitation causes the scanner to crash, creating a window where malware may evade detection. In regulated environments (finance, healthcare, government), sustained scanner unavailability can trigger compliance violations and audit findings. For MSPs and security appliance vendors embedding ClamAV, this vulnerability directly affects customer SLAs and trust.

Affected systems

ClamAV is directly affected. Cisco Secure Endpoint (all versions mentioned in the vulnerability record) incorporates ClamAV for on-access and on-demand scanning. Any deployment of ClamAV—whether standalone on Linux/Unix servers, integrated into mail gateways, or bundled in third-party security products—is in scope. Organizations should verify whether their endpoint, gateway, or server protection solutions depend on ClamAV.

Exploitability

Exploitation is straightforward: an attacker crafts an FSG-compressed portable executable file and submits it for scanning (via email, file upload, malware honeypot, or direct file placement on a monitored system). No authentication, user interaction, or special network position is required. The attack succeeds if the vulnerable ClamAV process is accessible and actively scanning user-controlled files. Public exploit code has not been reported, but the vulnerability is not complex to weaponize given the detailed technical description.

Remediation

Apply the latest patched version of ClamAV from the official ClamAV project repository. Verify the patch version against Cisco and ClamAV security advisories to confirm the FSG parser boundary check has been corrected. For Cisco Secure Endpoint users, updates are typically delivered through the Cisco security update channels; prioritize deployment in environments scanning untrusted files. As a temporary mitigation, disable FSG decompression in ClamAV configuration if feasible, though this may reduce malware detection capability.

Patch guidance

Check the ClamAV project's official release notes and security advisories for the version that remediates this boundary check issue. Cisco customers should consult the Cisco Security Advisory related to CVE-2026-20214 for Secure Endpoint patch versions and deployment procedures. Test patches in a non-production environment first, especially if ClamAV is integrated into critical scanning infrastructure. Update the malware signature database alongside any engine patches. Establish a schedule to verify that all downstream products and integrations consuming ClamAV are updated.

Detection guidance

Monitor for unexpected ClamAV process crashes or high CPU spikes followed by scanner termination in antivirus logs and system event logs. Watch for malformed FSG-compressed files in network traffic or file repositories (FSG files typically have specific magic bytes and header patterns). Implement file type restrictions at ingestion points if FSG is not a legitimate business format. Review ClamAV logs for parsing errors or exceptions when processing attachments or uploaded files. Host-based intrusion detection can flag segmentation faults or abnormal process termination of the scanner daemon.

Why prioritize this

This vulnerability merits immediate attention because it directly disrupts the availability of a security control (malware scanning) through a network-reachable, unauthenticated attack. The HIGH CVSS score and ease of exploitation outweigh the fact that it is not yet in CISA's KEV catalog. Organizations in regulated industries or those handling sensitive data cannot tolerate scanner unavailability. Although the vulnerability does not leak data or corrupt files directly, its denial-of-service impact on threat detection creates a critical security gap.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N/UI:N), and high impact on availability (A:H). The lack of confidentiality and integrity impact keeps the score below critical range. However, in the context of a malware scanner, availability is the primary function; disrupting it elevates real-world risk beyond the numeric score. Organizations should consider local context (how exposed is the ClamAV process to untrusted input) when determining internal priority.

Frequently asked questions