CVE-2026-20244: ClamAV DMG Parser Memory Corruption DoS Vulnerability

Technical summary

CVE-2026-20244 is a memory corruption vulnerability in ClamAV's DMG file format parser caused by insufficient boundary checking during content processing. The flaw manifests as an integer overflow condition that occurs exclusively on 32-bit platforms when parsing specially crafted DMG files. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), indicating a classic boundary validation gap. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable attack requiring no privileges or user interaction, with availability impact as the primary concern. While the described impact centers on denial of service, the vulnerability's nature—memory corruption via integer overflow—could potentially enable further exploitation depending on memory layout and platform specifics.

Business impact

Organizations relying on ClamAV or Cisco Secure Endpoint for malware scanning face service unavailability if targeted with exploit files. The denial of service impact is operationally significant: scanning engines that crash cannot protect systems against subsequent malware delivery, creating a window of vulnerability. For MSPs and enterprises running ClamAV across multiple endpoints or mail gateways, widespread exploitation could compromise threat detection coverage. The 32-bit platform restriction limits scope, but many legacy systems, embedded appliances, and specialized infrastructure still operate on 32-bit architectures. Attackers could weaponize this to disable defenses during coordinated campaigns.

Affected systems

ClamAV (all affected versions) and Cisco Secure Endpoint are the documented vulnerable products. The vulnerability applies exclusively to 32-bit deployments; 64-bit systems are not affected. This includes ClamAV running on 32-bit Linux distributions, Windows systems with 32-bit agent installations, and legacy mail gateway appliances. Cisco Secure Endpoint versions running the vulnerable ClamAV engine on 32-bit platforms are similarly impacted. Systems using 64-bit builds of ClamAV or Secure Endpoint are not vulnerable to this specific flaw.

Exploitability

Exploitability is straightforward. An attacker can craft a malicious DMG file—a relatively simple binary modification—and submit it for scanning via email, file upload endpoints, or direct API calls. The attack surface is broad because any network path leading to ClamAV (mail gateways, web upload handlers, API endpoints) becomes an attack vector. No special privileges, authentication, or user interaction is needed. However, the attacker must have a route to deliver the file to a 32-bit ClamAV instance. CVSS AC:L reflects this low complexity. The absence of KEV designation suggests that as of the published date, active exploitation in the wild was not publicly documented, though this does not preclude exploitation by determined threat actors.

Remediation

Update ClamAV and Cisco Secure Endpoint to patched versions that include proper boundary validation in the DMG parser. For organizations unable to immediately patch, implement compensating controls: restrict DMG file uploads at perimeter points, reduce ClamAV exposure by running instances only where necessary, and prioritize patching for customer-facing or critical scanning nodes. Prioritize remediation on 32-bit deployments first, as they are the sole attack surface. Monitor for scanning process crashes and unexpected service terminations as indicators of exploitation attempts.

Patch guidance

Consult vendor advisories from Cisco (for Secure Endpoint) and the ClamAV project for specific patched version numbers and release dates. Typically, security updates are released to stable channels; verify compatibility with your deployment before applying. Test patches in a non-production environment on both 32-bit and 64-bit builds to confirm stability. Schedule patching windows to minimize scanning downtime, or employ redundant scanning infrastructure to maintain coverage during updates. Given the straightforward nature of the attack (file submission), patch deployments should be treated as priority.

Detection guidance

Monitor ClamAV process logs and system event logs for abnormal terminations or crashes of the clamd daemon or scanning processes. Alert on repeated scanning process restarts within short timeframes. Network detection is challenging because the exploit traffic appears as normal file submission; focus instead on behavioral anomalies: monitoring for DMG files submitted to scanning endpoints outside normal business patterns, or DMG submissions to non-Mac environments (where they are unusual). Endpoint Detection and Response (EDR) tools can flag process crashes linked to ClamAV. Consider enabling verbose logging in ClamAV to capture parser errors preceding crashes.

Why prioritize this

This vulnerability merits prompt but measured prioritization. The HIGH CVSS score (7.5) reflects the ease of exploitation and lack of authentication requirements. Availability impact is direct—scanning engines stop functioning. However, platform scope is narrow: only 32-bit systems are vulnerable, significantly reducing affected infrastructure in modern environments where 64-bit dominates. The absence of active exploitation (no KEV listing) suggests lower immediate urgency than actively exploited vulns, but does not diminish the need to patch. Recommend prioritizing 32-bit ClamAV deployments at network perimeters (mail gateways, web filters) and customer-facing appliances first, then cascading to internal systems.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) network-based attack vector requiring no credentials or user interaction (AV:N/PR:N/UI:N), making exploitation broadly accessible; (2) low attack complexity (AC:L), as crafting a malicious DMG is trivial; (3) direct availability impact (A:H) with no confidentiality or integrity compromise—scanning processes crash, disabling defenses. The score does not account for the 32-bit-only platform restriction, which in practice narrows real-world impact. Organizations with primarily 64-bit infrastructure may lower their internal risk rating, but should not dismiss the vulnerability if any 32-bit scanning infrastructure exists.

Frequently asked questions