CVE-2026-20346: Out-of-bounds Read in Cisco Cisco Secure Endpoint
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
AI Analysis
Technical Summary
This vulnerability arises from improper boundary checks in the PDF parser component of ClamAV integrated into Cisco Secure Endpoint. Specifically, crafted PDF files can trigger an out-of-bounds buffer read during scanning, leading to memory corruption. The primary impact is a denial-of-service condition caused by termination of the scanning process. The vulnerability requires no privileges and no user interaction, and can be triggered remotely by submitting malicious PDF files for scanning. The CVSS v3.1 base score is 7.5, reflecting high severity due to the ease of exploitation and impact on availability. Affected versions include a wide range of Cisco Secure Endpoint releases explicitly enumerated in the input data. No patch or remediation details are provided in the source data.
Potential Impact
Successful exploitation results in denial of service by terminating the ClamAV scanning process on affected Cisco Secure Endpoint devices. There is no indication of confidentiality or integrity compromise. The vulnerability can be triggered remotely without authentication or user interaction, potentially disrupting endpoint security scanning operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is indicated in the provided data, users should monitor Cisco's security advisories for updates. Until a patch is available, consider restricting or monitoring the submission of PDF files for scanning if feasible to reduce exposure.
CVE-2026-20346: Out-of-bounds Read in Cisco Cisco Secure Endpoint
Description
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVSS v3.1
Score 7.5high
Affected software
Cisco
Cisco Secure Endpoint
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper boundary checks in the PDF parser component of ClamAV integrated into Cisco Secure Endpoint. Specifically, crafted PDF files can trigger an out-of-bounds buffer read during scanning, leading to memory corruption. The primary impact is a denial-of-service condition caused by termination of the scanning process. The vulnerability requires no privileges and no user interaction, and can be triggered remotely by submitting malicious PDF files for scanning. The CVSS v3.1 base score is 7.5, reflecting high severity due to the ease of exploitation and impact on availability. Affected versions include a wide range of Cisco Secure Endpoint releases explicitly enumerated in the input data. No patch or remediation details are provided in the source data.
Potential Impact
Successful exploitation results in denial of service by terminating the ClamAV scanning process on affected Cisco Secure Endpoint devices. There is no indication of confidentiality or integrity compromise. The vulnerability can be triggered remotely without authentication or user interaction, potentially disrupting endpoint security scanning operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is indicated in the provided data, users should monitor Cisco's security advisories for updates. Until a patch is available, consider restricting or monitoring the submission of PDF files for scanning if feasible to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2025-10-08T11:59:15.413Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a760e52bf8831d539a765e2
Added to database: 08/07/2026, 16:56:50 UTC
Last enriched: 08/07/2026, 17:12:50 UTC
Last updated: 09/21/2026, 22:01:32 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.