This vulnerability arises from the InstallShield file format parser in ClamAV integrated within Cisco Secure Endpoint. Improper handling of temporary resources during file scanning allows an unauthenticated remote attacker to cause a denial-of-service by submitting a malicious InstallShield file. Exploitation results in termination of the scanning process and temporary resource exhaustion on the affected device. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. There is no vendor advisory or patch information provided, and the remediation level is unspecified.

Successful exploitation causes denial-of-service by terminating the ClamAV scanning process and consuming system resources temporarily. This disrupts the malware scanning capabilities of Cisco Secure Endpoint, potentially reducing endpoint protection effectiveness during the DoS condition. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider limiting exposure of Cisco Secure Endpoint scanning interfaces to untrusted sources and monitor for abnormal resource consumption related to scanning processes.