CVE-2026-20244: ClamAV DMG Parser DoS Vulnerability

CVE-2026-20244 Overview

CVE-2026-20244 is an integer overflow vulnerability in the DMG file format parser of ClamAV. The flaw enables an unauthenticated, remote attacker to trigger memory corruption by submitting a crafted DMG file for scanning. Successful exploitation terminates the ClamAV scanning process, producing a denial-of-service (DoS) condition. The vulnerability affects 32-bit platforms only and is tracked under [CWE-120] (Buffer Copy without Checking Size of Input). Cisco published the coordinated disclosure through its security advisory channel.

Critical Impact
Remote attackers can crash ClamAV scanning processes on 32-bit platforms by supplying a malicious DMG file, disrupting antivirus coverage on affected systems.

Affected Products

ClamAV DMG file format parser (32-bit platforms)
Cisco products embedding vulnerable ClamAV versions
Downstream distributions bundling the affected ClamAV release

Discovery Timeline

2026-07-01 - CVE CVE-2026-20244 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-20244

Vulnerability Analysis

The vulnerability resides in the DMG (Apple Disk Image) file format parser used by ClamAV during scanning. When the parser processes attacker-controlled length or offset fields inside a DMG file, arithmetic on those values wraps around on 32-bit platforms. The resulting undersized allocation or miscalculated boundary leads to memory corruption. According to the advisory, the primary observable outcome is termination of the scanning process, causing loss of antivirus availability. Cisco notes that expanded impacts beyond DoS may be possible depending on runtime conditions.

Root Cause

The root cause is improper boundary validation on content fields parsed from DMG files. Arithmetic performed on untrusted 32-bit integer values overflows before bounds checks are applied. The overflow produces sizes that pass validation but are inconsistent with the actual data being processed. This mismatch drives out-of-bounds memory access during subsequent parsing operations.

Attack Vector

An attacker delivers a crafted DMG file to any interface where ClamAV performs scanning. Common vectors include email gateways, file upload endpoints, shared storage inspection, and web proxies that forward attachments to ClamAV. No authentication and no user interaction are required. The attack requires only that the file reach the scanner. For technical details, refer to the Cisco Security Advisory.

No verified public exploit code is available. The vulnerability is described in prose only; see the vendor advisory for parser-level specifics.

Detection Methods for CVE-2026-20244

Indicators of Compromise

Unexpected termination or crash of the clamd or clamscan process during scanning
Scanner engine restart events correlated with DMG file inspection
Repeated submission of DMG files to mail, web, or file-share scanning pipelines from a single source

Detection Strategies

Monitor ClamAV process exit codes and abnormal termination signals in system logs
Alert on gaps in antivirus scanning coverage where DMG files were queued but not completed
Inspect mail and web gateway logs for DMG attachments preceding scanner failures

Monitoring Recommendations

Track ClamAV service availability with uptime checks and alert on repeated restarts
Correlate clamd crash telemetry with the hash and origin of the most recently scanned file
Forward scanner logs to a centralized SIEM for pattern analysis across gateways

How to Mitigate CVE-2026-20244

Immediate Actions Required

Identify all systems running ClamAV on 32-bit platforms and prioritize them for patching
Apply the fixed ClamAV release referenced in the Cisco Security Advisory
Restart clamd after upgrading to load the patched engine

Patch Information

Cisco has published guidance and fixed versions through the Cisco Security Advisory cisco-sa-clamav-88cFYyxR. Administrators should upgrade to the ClamAV release identified in that advisory. Products that embed ClamAV, including Cisco Secure Email and Secure Endpoint components, receive fixes through their respective update channels.

Workarounds

Migrate scanning workloads from 32-bit to 64-bit platforms, which are not affected by this integer overflow
Disable DMG parsing in the ClamAV configuration if scanning of Apple disk images is not required
Filter DMG attachments at mail and web gateways until patched engines are deployed

bash

# Disable DMG scanning in clamd.conf until patched
echo "ScanArchive yes" >> /etc/clamav/clamd.conf
echo "ScanDMG no" >> /etc/clamav/clamd.conf
systemctl restart clamav-daemon