CVE-2026-20216

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:secure_endpoint::::::macos::*
	cpe:2.3:a:cisco:secure_endpoint::::::linux::*
	cpe:2.3:a:cisco:secure_endpoint::::::windows::*

Configuration 2 (hide)

OR	cpe:2.3:a:clamav:clamav::::::::
	cpe:2.3:a:clamav:clamav::::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el analizador de formato de archivo InstallShield de ClamAV podría permitir a un atacante remoto no autenticado causar una condición de DoS en un dispositivo afectado. Esta vulnerabilidad se debe a un manejo inadecuado de recursos temporales durante el escaneo de archivos. Un atacante podría explotar esta vulnerabilidad al enviar un archivo InstallShield manipulado para ser escaneado por ClamAV en un dispositivo afectado. Un exploit exitoso podría permitir al atacante terminar el proceso de escaneo de ClamAV y consumir temporalmente los recursos del sistema disponibles, lo que resultaría en una condición de DoS en el software afectado.

Information

Published : 2026-07-01 17:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-20216

Mitre link : CVE-2026-20216

CVE.ORG link : CVE-2026-20216

JSON object : View

Products Affected

cisco

secure_endpoint

clamav

clamav

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-20216", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20216", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T17:18:03.116587Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Secure Endpoint", "versions": [{"status": "affected", "version": "7.0.5"}, {"status": "affected", "version": "6.2.19"}, {"status": "affected", "version": "7.3.3"}, {"status": "affected", "version": "7.2.13"}, {"status": "affected", "version": "6.1.5"}, {"status": "affected", "version": "6.3.1"}, {"status": "affected", "version": "6.2.5"}, {"status": "affected", "version": "7.3.5"}, {"status": "affected", "version": "6.2.1"}, {"status": "affected", "version": "7.2.7"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "6.3.5"}, {"status": "affected", "version": "6.2.9"}, {"status": "affected", "version": "7.3.1"}, {"status": "affected", "version": "6.1.7"}, {"status": "affected", "version": "7.2.11"}, {"status": "affected", "version": "7.2.3"}, {"status": "affected", "version": "7.1.5"}, {"status": "affected", "version": "6.3.3"}, {"status": "affected", "version": "7.3.9"}, {"status": "affected", "version": "6.2.3"}, {"status": "affected", "version": "6.1.9"}, {"status": "affected", "version": "6.0.9"}, {"status": "affected", "version": "7.2.5"}, {"status": "affected", "version": "6.0.7"}, {"status": "affected", "version": "6.3.7"}, {"status": "affected", "version": "1.12.3"}, {"status": "affected", "version": "1.8.0"}, {"status": "affected", "version": "1.11.1"}, {"status": "affected", "version": "1.12.4"}, {"status": "affected", "version": "1.10.0"}, {"status": "affected", "version": "1.12.0"}, {"status": "affected", "version": "1.8.1"}, {"status": "affected", "version": "1.10.1"}, {"status": "affected", "version": "1.12.1"}, {"status": "affected", "version": "1.12.6"}, {"status": "affected", "version": "1.14.0"}, {"status": "affected", "version": "1.10.2"}, {"status": "affected", "version": "1.12.7"}, {"status": "affected", "version": "1.12.2"}, {"status": "affected", "version": "1.6.0"}, {"status": "affected", "version": "1.9.0"}, {"status": "affected", "version": "1.11.0"}, {"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.13.0"}, {"status": "affected", "version": "1.8.4"}, {"status": "affected", "version": "1.13.1"}, {"status": "affected", "version": "1.9.1"}, {"status": "affected", "version": "1.12.5"}, {"status": "affected", "version": "1.13.2"}, {"status": "affected", "version": "8.1.7.21512"}, {"status": "affected", "version": "8.1.7"}, {"status": "affected", "version": "8.1.5"}, {"status": "affected", "version": "8.1.3.21242"}, {"status": "affected", "version": "8.1.3"}, {"status": "affected", "version": "8.1.5.21322"}, {"status": "affected", "version": "8.1.7.21417"}, {"status": "affected", "version": "1.14.1"}, {"status": "affected", "version": "1.15.1"}, {"status": "affected", "version": "1.15.2"}, {"status": "affected", "version": "1.15.3"}, {"status": "affected", "version": "1.15.4"}, {"status": "affected", "version": "1.15.5"}, {"status": "affected", "version": "1.15.6"}, {"status": "affected", "version": "1.16.0"}, {"status": "affected", "version": "1.16.1"}, {"status": "affected", "version": "1.16.2"}, {"status": "affected", "version": "1.16.3"}, {"status": "affected", "version": "1.18.0"}, {"status": "affected", "version": "1.18.1"}, {"status": "affected", "version": "1.20.0"}, {"status": "affected", "version": "1.21.0"}, {"status": "affected", "version": "1.21.1"}, {"status": "affected", "version": "1.21.2"}, {"status": "affected", "version": "1.21.3"}, {"status": "affected", "version": "1.22.0"}, {"status": "affected", "version": "1.22.1"}, {"status": "affected", "version": "1.22.2"}, {"status": "affected", "version": "1.22.3"}, {"status": "affected", "version": "1.22.4"}, {"status": "affected", "version": "1.24.0"}, {"status": "affected", "version": "1.24.1"}, {"status": "affected", "version": "1.24.2"}, {"status": "affected", "version": "1.24.3"}, {"status": "affected", "version": "1.24.4"}, {"status": "affected", "version": "1.26.0"}, {"status": "affected", "version": "1.24.5"}, {"status": "affected", "version": "1.26.1"}, {"status": "affected", "version": "1.27.0"}, {"status": "affected", "version": "1.15.0"}, {"status": "affected", "version": "1.17.0"}, {"status": "affected", "version": "1.17.1"}, {"status": "affected", "version": "1.17.2"}, {"status": "affected", "version": "1.19.0"}, {"status": "affected", "version": "1.20.1"}, {"status": "affected", "version": "1.20.2"}, {"status": "affected", "version": "1.20.3"}, {"status": "affected", "version": "1.20.4"}, {"status": "affected", "version": "1.20.5"}, {"status": "affected", "version": "1.20.6"}, {"status": "affected", "version": "1.23.0"}, {"status": "affected", "version": "1.23.1"}, {"status": "affected", "version": "1.20.7"}, {"status": "affected", "version": "1.20.8"}, {"status": "affected", "version": "1.25.0"}, {"status": "affected", "version": "1.25.1"}, {"status": "affected", "version": "1.25.2"}, {"status": "affected", "version": "1.27.1"}, {"status": "affected", "version": "1.27.2"}, {"status": "affected", "version": "7.3.13"}, {"status": "affected", "version": "7.3.15"}, {"status": "affected", "version": "7.4.1"}, {"status": "affected", "version": "7.4.1.20425"}, {"status": "affected", "version": "7.4.1.20439"}, {"status": "affected", "version": "7.4.3"}, {"status": "affected", "version": "7.4.3.20679"}, {"status": "affected", "version": "7.4.5"}, {"status": "affected", "version": "7.5.1.20813"}, {"status": "affected", "version": "7.5.1.20833"}, {"status": "affected", "version": "7.5.3"}, {"status": "affected", "version": "7.5.5"}, {"status": "affected", "version": "8.0.1.21160"}, {"status": "affected", "version": "8.0.1.21164"}, {"status": "affected", "version": "7.5.7"}, {"status": "affected", "version": "7.5.9"}, {"status": "affected", "version": "7.5.11"}, {"status": "affected", "version": "8.1.7.21585"}, {"status": "affected", "version": "7.5.13.21586"}, {"status": "affected", "version": "7.5.13.21598"}, {"status": "affected", "version": "8.2.1.21612"}, {"status": "affected", "version": "8.2.1.21650"}, {"status": "affected", "version": "7.5.15.21611"}, {"status": "affected", "version": "7.5.17.21680"}, {"status": "affected", "version": "8.2.3.30119"}, {"status": "affected", "version": "8.2.4.30130"}, {"status": "affected", "version": "8.4.0"}, {"status": "affected", "version": "7.5.19"}, {"status": "affected", "version": "8.4.1.30298"}, {"status": "affected", "version": "8.4.2.30317"}, {"status": "affected", "version": "8.4.1.30307"}, {"status": "affected", "version": "7.5.20"}, {"status": "affected", "version": "8.4.3"}, {"status": "affected", "version": "8.4.4.30419"}, {"status": "affected", "version": "8.4.4.30467"}, {"status": "affected", "version": "7.5.21.21732"}, {"status": "affected", "version": "8.4.5.30483"}], "defaultStatus": "unknown"}]}], "published": "2026-07-01T17:16:29.973", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software."}, {"lang": "es", "value": "Una vulnerabilidad en el analizador de formato de archivo InstallShield de ClamAV podr\u00eda permitir a un atacante remoto no autenticado causar una condici\u00f3n de DoS en un dispositivo afectado.\n\nEsta vulnerabilidad se debe a un manejo inadecuado de recursos temporales durante el escaneo de archivos. Un atacante podr\u00eda explotar esta vulnerabilidad al enviar un archivo InstallShield manipulado para ser escaneado por ClamAV en un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante terminar el proceso de escaneo de ClamAV y consumir temporalmente los recursos del sistema disponibles, lo que resultar\u00eda en una condici\u00f3n de DoS en el software afectado."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "E534D1FF-B590-40F3-9874-AC2BDA807087", "versionEndExcluding": "1.27.2"}, {"criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "CB2B4CBA-534A-4111-8920-8580B12C4F46", "versionEndExcluding": "1.29.0"}, {"criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "4EB7F99A-01AB-44EE-B682-5E2C9E7D2A4B", "versionEndExcluding": "8.6.2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD23E971-4735-4C28-BFE1-AB807630F2EE", "versionEndExcluding": "1.4.5"}, {"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CC3C470-BBC6-449E-80F1-F9E762442D3C", "versionEndExcluding": "1.5.3", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}