This vulnerability in Cisco Secure Endpoint involves the GPT file format parser component of ClamAV. Due to improper endian conversion handling, an attacker can submit a maliciously crafted GPT file that causes an out-of-bounds buffer write, leading to memory corruption. This triggers a stack-based buffer overflow that causes the ClamAV scanning process to crash, resulting in a denial-of-service condition. The vulnerability requires no privileges or user interaction and can be triggered remotely by sending the crafted file to be scanned. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (DoS).

Successful exploitation causes the ClamAV scanning process within Cisco Secure Endpoint to terminate unexpectedly, resulting in a denial-of-service condition. There is no indication of confidentiality or integrity impact. The vulnerability does not require authentication or user interaction, making it remotely exploitable. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid scanning untrusted GPT files or implement additional filtering controls to prevent malicious GPT files from reaching the scanning engine.