CVE detail
CVE-2026-20338
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 4
- within the 30d window
- Peak daily
- 2
- highest bucket
Evidence
Source links by recency
4 source links · newest first
- ClamAV Vulnerabilities Affecting Cisco Products: August 2026Cisco Security Advisories
apps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 Security Impact Rating: High CVE: CVE-2026-20337,CVE-2026-20338,CVE-2026-20339,CVE-2026-20345,CVE-2026-20346,CVE-2026-20347,CVE-2026-20348
vendorsec.cloudapps.cisco.comAug 13, 2026, 8:11 PM - Cisco Warns of Seven ClamAV Flaws, Two With Public PoCsSecurity Affairs
ause a denial of service (DoS) condition, interrupting scanning operations.” reads the advisory . The flaws, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, affect ClamAV parsers for several file formats. ClamAV fixed them in version 1.5.4 , Cisco later warned that public PoCs are available for the vulnerabilities CVE-
newssecurityaffairs.comAug 11, 2026, 4:05 PM Information published.
vendormsrc.microsoft.comAug 11, 2026, 8:17 AM- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26sec.cloudapps.cisco.com
No excerpt available.
Vendor Advisorysec.cloudapps.cisco.comAug 7, 2026, 5:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-18663CVSS 5.9 · Medium
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without cleari…
- CVE-2026-65780CVSS 7.0 · High
Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.
- CVE-2026-62889CVSS 8.1 · High
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
- CVE-2026-62766CVSS 7.0 · High
Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
- CVE-2026-61366CVSS 7.0 · High
Double free in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.
- CVE-2026-11894CVSS 5.9 · Medium
The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract…