CVE-2026-20216

EUVD-2026-41081

01.07.2026, 17:16

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.

This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 40.55%

Affected Products (NVD)

Vendor	Product	Version
cisco	secure_endpoint	𝑥 < 1.27.2
cisco	secure_endpoint	𝑥 < 1.29.0
cisco	secure_endpoint	𝑥 < 8.6.2
clamav	clamav	𝑥 < 1.4.5
clamav	clamav	1.5.0 ≤ 𝑥 < 1.5.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

clamav

bookworm	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	1.4.5+dfsg-3 fixed
sid	1.4.5+dfsg-3 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

clamav

bionic	needs-triage
focal	needs-triage
jammy	Fixed 1.5.3+dfsg-0ubuntu0.22.04.2 released
noble	Fixed 1.5.3+dfsg-0ubuntu0.24.04.1 released
questing	ignored
resolute	Fixed 1.5.3+dfsg-0ubuntu0.26.04.1 released
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

clamav

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

clamav-devel

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

clamav-docs-html

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

clamav-milter

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

libclamav12

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

libclammspack0

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP3	1.4.5-36.25.2 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

libfreshclam3

suse enterprise server 12 SP3

1.4.5-36.25.2

fixed

libfreshclam4

suse enterprise desktop 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise sap 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise sap 15 SP7	1.5.3-150600.18.28.1 fixed
suse enterprise server 12 SP5	1.5.3-3.56.1 fixed
suse enterprise server 15 SP4	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP5	1.5.3-150400.13.8.1 fixed
suse enterprise server 15 SP6	1.5.3-150600.18.28.1 fixed
suse enterprise server 15 SP7	1.5.3-150600.18.28.1 fixed

Amazon Linux Releases

Amazon Package

Release

clamav1.4

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-data

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-debuginfo

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-debugsource

Amazon Linux 2023

0:1.4.5-1.amzn2023.0.1

fixed

clamav1.4-devel

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-doc

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-filesystem

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-freshclam

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-freshclam-debuginfo

Amazon Linux 2023

0:1.4.5-1.amzn2023.0.1

fixed

clamav1.4-lib

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-lib-debuginfo

Amazon Linux 2023

0:1.4.5-1.amzn2023.0.1

fixed

clamav1.4-milter

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamav1.4-milter-debuginfo

Amazon Linux 2023

0:1.4.5-1.amzn2023.0.1

fixed

clamav1.5

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-data

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-debuginfo

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-debugsource

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-devel

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-doc

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-filesystem

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-freshclam

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-freshclam-debuginfo

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-lib

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-lib-debuginfo

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-milter

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamav1.5-milter-debuginfo

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamd1.4

Amazon Linux 2	0:1.4.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:1.4.5-1.amzn2023.0.1 fixed

clamd1.4-debuginfo

Amazon Linux 2023

0:1.4.5-1.amzn2023.0.1

fixed

clamd1.5

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

clamd1.5-debuginfo

Amazon Linux 2023

0:1.5.3-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

clamav

Azure Linux 3.0

0:1.5.3-1.azl3

fixed

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR