CVE-2026-20244

A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.

This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "cpes": [
                "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*",
                "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:macos:*:*",
                "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:windows:*:*"
            ],
            "vendor_product": "cisco:secure_endpoint",
            "extracted_events": [
                {
                    "fixed": "1.27.2"
                },
                {
                    "fixed": "1.29.0"
                },
                {
                    "fixed": "8.6.2"
                }
            ]
        }
    ]
}

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-88cFYyxR

Affected packages

Git / github.com/cisco-talos/clamav

Affected ranges

Type

GIT

Repo

https://github.com/cisco-talos/clamav

Events

Introduced

5d17fd44bf6f0f16269bea4947a63868d7061cb2

Fixed

e8b337754d18b6bc46d565e7b6d82843debb4793

Introduced

83fd7f14fb8098826108be124219400ff08f44f7

Fixed

b970812e9b6427e361c362762d94f7356597efe4

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0.98.1"
        },
        {
            "fixed": "1.4.5"
        },
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "1.5.3"
        }
    ],
    "cpe": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*"
}

Affected versions

clamav-1.*

clamav-1.5.0

clamav-1.5.1

clamav-1.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-20244.json"

vanir_signatures

[
    {
        "source": "https://github.com/cisco-talos/clamav/commit/b970812e9b6427e361c362762d94f7356597efe4",
        "digest": {
            "line_hashes": [
                "292730809324198135824456427123530982316",
                "48909975112402718040840392598089442483",
                "244709564196882964306236474155638759448",
                "70870381860622873231048469217867683607",
                "48280512302990451540812787021173843633",
                "84063886632477573345883041956578632475",
                "306992310433978823207970714918426559768"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "libclamav/bytecode_api.h"
        },
        "id": "CVE-2026-20244-42df490f"
    },
    {
        "source": "https://github.com/cisco-talos/clamav/commit/e8b337754d18b6bc46d565e7b6d82843debb4793",
        "digest": {
            "line_hashes": [
                "25980081304948595529773044318868766445",
                "139490683882163062933958223590198381964",
                "30447695047841737820267435943470810888",
                "167323549575839547577856716504685264826"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "libclamav/bytecode_api.h"
        },
        "id": "CVE-2026-20244-ad39e5e0"
    }
]

vanir_signatures_modified

"2026-07-15T07:30:14Z"