CVE-2026-20339: ClamAV PESpin Parser DoS Vulnerability

CVE-2026-20339 Overview

CVE-2026-20339 is an integer overflow vulnerability in the PESpin file format parser of ClamAV. The flaw allows an unauthenticated, remote attacker to trigger memory corruption by submitting a crafted file for scanning. Successful exploitation terminates the ClamAV scanning process, producing a denial-of-service condition. The vulnerability is tracked as CWE-190: Integer Overflow or Wraparound.

Critical Impact
A remote attacker can crash the ClamAV scanning engine by submitting a single crafted PESpin-packed file, disabling malware scanning on affected systems.

Affected Products

ClamAV (versions incorporating the PESpin file format parser)
Cisco products bundling the vulnerable ClamAV engine
Third-party security appliances and mail gateways using ClamAV for scanning

Discovery Timeline

2026-08-07 - CVE-2026-20339 published to the National Vulnerability Database
2026-08-11 - Last updated in the NVD database

Technical Details for CVE-2026-20339

Vulnerability Analysis

The vulnerability resides in the PESpin file format parser within ClamAV. PESpin is a Windows Portable Executable (PE) packer historically used to obfuscate binaries, and ClamAV includes unpacking logic to inspect the underlying payload during scanning.

The parser performs arithmetic on size and offset fields extracted from attacker-controlled file content without adequate boundary validation. When those values are manipulated, the arithmetic wraps around, producing a truncated size that later drives memory operations. The result is memory corruption inside the scanning process.

Exploitation requires no authentication, no user interaction, and no privileges. The attacker only needs to deliver a crafted file to any interface that hands data to ClamAV — email attachments, uploaded files, on-access scanners, or ICAP-connected proxies.

Root Cause

The root cause is improper boundary checking of size and length fields parsed from PESpin-packed input. Untrusted values propagate into arithmetic operations that overflow the underlying integer type. Downstream code then trusts the corrupted value when allocating buffers or computing copy lengths, leading to out-of-bounds memory access and process termination.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker crafts a file containing malformed PESpin content and routes it to a system running a vulnerable ClamAV instance. Once ClamAV attempts to scan the file, the parser triggers the overflow and the scanning process crashes. Repeated submissions can sustain the denial-of-service condition and disable malware protection during that window.

No verified proof-of-concept code is publicly available. Refer to the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-20339

Indicators of Compromise

Unexpected termination or crash logs from the clamd daemon or clamscan process during file scanning operations.
Core dumps or segmentation fault entries in system logs correlated with ClamAV scanning activity.
Scanning queue backlogs on mail gateways and file upload pipelines that rely on ClamAV.
Repeated inbound files with anomalous PE headers or PESpin packer signatures arriving from a single source.

Detection Strategies

Monitor ClamAV process health and alert on abnormal exit codes, restarts, or SIGSEGV events.
Inspect scanned file metadata for PESpin-packed executables and correlate with scanner crash events within the same time window.
Deploy YARA rules that flag malformed PESpin section headers with impossible size or offset values.

Monitoring Recommendations

Forward ClamAV logs and host telemetry to a centralized data lake for correlation across mail, web, and endpoint scanning paths.
Track scanner uptime and success ratios as a service-level indicator; sudden drops often precede exploitation attempts.
Alert on repeated submissions of the same file hash to scanning services after a crash event.

How to Mitigate CVE-2026-20339

Immediate Actions Required

Upgrade ClamAV to a patched release identified in the Cisco Security Advisory.
Inventory all systems and appliances that embed ClamAV, including mail gateways, file scanners, and third-party security products.
Enable automatic restart of the clamd service to reduce downtime if the scanner is crashed.
Restrict file submission channels to authenticated or rate-limited users where feasible.

Patch Information

Cisco has published fixed versions of ClamAV addressing the PESpin parser integer overflow. Consult the Cisco Security Advisory for the specific fixed versions and download locations. Vendors bundling ClamAV should apply their downstream updates once released.

Workarounds

Disable PE file unpacking in ClamAV configuration until patches are applied by setting ScanPE no in clamd.conf, accepting reduced detection coverage as a tradeoff.
Filter or block executable file types at the mail gateway or upload boundary to prevent PESpin-packed samples from reaching the scanner.
Deploy scanning workers behind a supervisor process that automatically restarts terminated ClamAV instances to limit outage duration.

bash

# Configuration example: disable PE unpacking as a temporary mitigation
# Edit /etc/clamav/clamd.conf
ScanPE no

# Restart the ClamAV daemon to apply the change
sudo systemctl restart clamav-daemon

# Verify the daemon is running
sudo systemctl status clamav-daemon