TI-2026-16529 Aliases CVE-2026-20345 GHSA-775x-c574-8mff

ClamAV GPT File Format Processing Memory Corruption Vulnerability

MEDIUM 40CWE-121Published 2026-08-07 · Updated 2026-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00559 46th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Secure Endpoint	1.12.3; 1.8.0; 1.11.1; 1.12.4; 1.10.0; 1.12.0; 1.8.1; 1.10.1; 1.10.2; 1.12.2; 1.6.0; 1.9.0; 1.7.0; 1.12.1; 1.12.6; 1.8.4; 1.11.0; 1.9.1; 1.12.5; 2.0.2; 1.1.0; 1.14.0; 2.4.0; 1.15.2; 1.16.0; 1.21.0; 1.22.2; 1.24.5; 1.19.0	—	No fix listed	CNA

Cisco Secure Endpoint VendorCisco Affected 1.12.3; 1.8.0; 1.11.1; 1.12.4; 1.10.0; 1.12.0; 1.8.1; 1.10.1; 1.10.2; 1.12.2; 1.6.0; 1.9.0; 1.7.0; 1.12.1; 1.12.6; 1.8.4; 1.11.0; 1.9.1; 1.12.5; 2.0.2; 1.1.0; 1.14.0; 2.4.0; 1.15.2; 1.16.0; 1.21.0; 1.22.2; 1.24.5; 1.19.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-20345
2026-10-03 Alias added: GHSA-775x-c574-8mff
2026-10-25 Priority changed: LOW → MEDIUM

References

Other 1

cisco-sa-clamav-WuuvVd26

TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0

See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences