This vulnerability arises from a buffer copy operation without proper size checking in the PESpin file format parser within ClamAV, which Cisco Secure Endpoint uses. The improper boundary checks allow an attacker to craft a malicious PESpin file that triggers an out-of-bounds buffer write during scanning. Exploitation results in memory corruption that can cause the ClamAV process to crash, leading to a denial-of-service condition. The vulnerability affects multiple specific versions of Cisco Secure Endpoint as listed. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation causes the ClamAV scanning process within Cisco Secure Endpoint to terminate unexpectedly, resulting in a denial-of-service condition. There is no indication of confidentiality or integrity impact, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is indicated, users should monitor Cisco advisories for updates. Until a fix is available, avoid scanning untrusted PESpin files or implement compensating controls if possible.