CVE-2026-20345: ClamAV GPT Parser DoS Vulnerability

CVE-2026-20345 Overview

CVE-2026-20345 is an out-of-bounds write vulnerability in the GUID Partition Table (GPT) file format parser of ClamAV. An unauthenticated, remote attacker can trigger memory corruption by submitting a crafted GPT file to be scanned by the ClamAV engine. Successful exploitation terminates the ClamAV scanning process, producing a denial-of-service (DoS) condition. Cisco notes that other expanded impacts are possible as a result of the memory corruption. The flaw is tracked under CWE-121: Stack-based Buffer Overflow and stems from improper handling of an endian conversion operation.

Critical Impact
Remote, unauthenticated attackers can crash the ClamAV scanning process by delivering a malicious GPT file, disabling antivirus scanning across affected deployments.

Affected Products

ClamAV (GPT file format parser component)
Cisco products that embed the ClamAV engine (refer to the Cisco advisory for the specific product matrix)
Third-party security and mail gateway products that bundle vulnerable ClamAV releases

Discovery Timeline

2026-08-07 - CVE-2026-20345 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-20345

Vulnerability Analysis

The vulnerability resides in the ClamAV GPT file format parser, which processes GUID Partition Table structures during file scanning. The parser performs an endian conversion operation on GPT header or partition entry fields without correctly validating the resulting values against destination buffer boundaries. When ClamAV scans a crafted GPT file, the byte-swapped values drive a write past the end of a stack buffer, corrupting adjacent memory.

The write occurs before any signature match is attempted, so exploitation does not depend on detection outcomes or on the file being flagged as malicious. Any code path that feeds a file into libclamav for GPT dissection is reachable, including on-access scanning, clamscan, clamd socket submissions, and integrations that pass attachments to ClamAV for inspection.

Root Cause

The defect is an improper handling of an endian conversion operation, classified as [CWE-121]. The parser converts multi-byte GPT fields from little-endian on-disk representation to host byte order, then uses the converted value as a size or offset without bounds validation. Attacker-controlled input yields a write outside the intended stack buffer.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction when ClamAV is deployed inline. An attacker submits a malformed GPT file through any ingestion path the scanner observes, including email attachments, HTTP uploads, file shares, or object storage feeds. The scanner process crashes on parse, halting antivirus coverage for subsequent files until the daemon is restarted.

The vulnerability is described in prose only; no verified public exploit code is available at this time. See the Cisco Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-20345

Indicators of Compromise

Unexpected termination or repeated restarts of clamd, clamscan, or freshclam-adjacent scanner processes.
Core dumps or segmentation fault entries in system logs referencing libclamav and GPT parsing functions.
Scan queue backlogs or timeouts in mail gateways and file-upload pipelines that rely on ClamAV.
Inbound files with .img, .iso, or raw disk image extensions containing malformed GPT headers.

Detection Strategies

Monitor process exit codes and signal terminations for the ClamAV scanning daemon and correlate against scan submission events.
Inspect GPT headers on ingested disk images for inconsistent partition entry sizes, oversized NumberOfPartitionEntries values, or byte-swap anomalies.
Alert on repeated scanner crashes originating from the same source address, sender, or upload session.

Monitoring Recommendations

Forward ClamAV daemon logs and system journal entries to a centralized logging platform for correlation with mail and web ingestion telemetry.
Track scanner uptime and mean time between restarts as an availability metric tied to this CVE.
Retain samples of files that trigger scanner crashes for offline analysis in an isolated environment.

How to Mitigate CVE-2026-20345

Immediate Actions Required

Apply the fixed ClamAV release identified in the Cisco Security Advisory as soon as it is available for your platform.
Inventory all systems and appliances that embed ClamAV, including mail gateways, file scanners, and endpoint agents, and confirm engine versions.
Restrict untrusted disk image uploads at the perimeter until patched builds are deployed.

Patch Information

Cisco Talos maintains ClamAV and publishes fixed engine versions through the Cisco Security Advisory. Downstream vendors that ship ClamAV (Linux distribution maintainers, mail gateway vendors, appliance vendors) should be tracked for updated package releases. Verify installed versions with clamscan --version and clamd --version after patching.

Workarounds

Disable GPT parsing at the scanner configuration layer where the option is exposed by the integrating product.
Use file-type filtering upstream of ClamAV to block or quarantine raw disk image formats such as .img, .iso, and .vmdk variants that carry GPT structures.
Configure watchdog or supervisor processes to automatically restart the ClamAV daemon on abnormal termination to reduce sustained DoS windows.

bash

# Verify installed ClamAV engine version and confirm patched build
clamscan --version
clamd --version

# Example: block raw disk images at a Postfix MTA using a header_checks rule
# /etc/postfix/header_checks
/^\s*Content-(Disposition|Type).*name\s*=\s*"?.+\.(img|iso|vmdk)"?/ REJECT Disk image attachments not permitted