CVE-2026-20216: ClamAV InstallShield Parser DoS Vulnerability

Technical summary

The vulnerability exists in ClamAV's InstallShield file format parser due to improper handling of temporary resources (CWE-770: Allocation of Resources Without Limits or Throttling). When the parser processes a maliciously crafted InstallShield file, it fails to properly release or limit temporary allocations, leading to resource exhaustion. The vulnerability manifests as process termination and temporary unavailability of the scanning engine. The attack vector is network-based with no authentication or interaction requirements, making it trivially easy to exploit. The CVSS v3.1 score of 7.5 (HIGH) reflects the availability impact combined with low attack complexity.

Business impact

Organizations relying on ClamAV for malware scanning—including enterprises using Cisco Secure Endpoint, which bundles ClamAV—face potential scanning service outages. Repeated exploitation could prevent timely threat detection and create an opening for actual malware to reach systems during scanning downtime. This is particularly concerning for email gateways, file servers, and intrusion prevention systems where ClamAV serves as a core detection layer. Attackers could exploit this to lower defenses before launching follow-up attacks.

Affected systems

ClamAV itself and Cisco Secure Endpoint (which integrates ClamAV) are the confirmed affected products. Any deployment of ClamAV—including open-source installations, commercial appliances, and cloud-based scanning services—is vulnerable. This encompasses mail servers using ClamAV plugins, web proxies with integrated scanning, network-attached storage devices running ClamAV, and endpoint protection suites bundling the engine.

Exploitability

Exploitation requires only the ability to submit or upload a file to a system running ClamAV. No authentication, social engineering, or user interaction is needed. The attacker simply crafts an InstallShield file (or uploads one to a monitored directory), triggering automatic scanning. The low complexity and remote nature make this a practical attack for adversaries of varying skill levels. However, the impact is limited to denial of service; code execution is not possible.

Remediation

Patch ClamAV and Cisco Secure Endpoint installations to patched versions released by their respective vendors. For ClamAV deployments, monitor vendor advisories for the specific patched version. For Cisco Secure Endpoint, apply security updates through your endpoint management platform. Interim mitigations include disabling or restricting InstallShield file scanning if your environment does not require it, though this reduces detection coverage. Monitor system logs for unexpected ClamAV process crashes as an indicator of exploitation attempts.

Patch guidance

Contact Cisco for Secure Endpoint patch availability and timing. For standalone ClamAV, verify patched versions against the official ClamAV project advisories and release notes. Given the HIGH severity and trivial exploitability, prioritize patching within 30 days. Test patches in a non-production environment first, especially if ClamAV is integral to security workflows. Coordinate patching across all affected systems simultaneously to minimize scanning gaps.

Detection guidance

Monitor for unexpected termination or repeated crashes of ClamAV processes or Secure Endpoint scanning services. Check logs for file scanning errors specifically mentioning InstallShield format parsing. Track submission of suspicious InstallShield files (.exe, .msi installers with unusual structure) to monitored systems. Implement alerting on scanning service downtime. Network-based detection is difficult, but monitoring for repeated scanning process restarts on inbound file upload activity may surface attack patterns.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, complete lack of authentication requirements, and direct impact on a critical security tool. Compromising ClamAV availability undermines the detection layer and creates operational risk. The ease of exploitation—any attacker can trigger it remotely—combined with the wide deployment of ClamAV in enterprise infrastructure elevates risk significantly. While not yet in the CISA KEV catalog, the simplicity of exploitation and the fundamental role of ClamAV in defense-in-depth strategies justifies treating this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N, UI:N), and high availability impact (A:H). The attack surface is broad because any system with network access to a ClamAV instance (or with file upload capabilities triggering ClamAV) is at risk. The lack of confidentiality or integrity impact prevents a critical rating, but the availability destruction and widespread deployment justify the HIGH severity classification.

Frequently asked questions