CVE-2026-20347: ClamAV Mach-O Parser DoS Vulnerability

CVE-2026-20347 Overview

CVE-2026-20347 is an out-of-bounds read vulnerability in the Mach-O file format parser of ClamAV. An unauthenticated, remote attacker can trigger memory corruption by submitting a crafted Mach-O file for scanning. Successful exploitation terminates the ClamAV scanning process, resulting in a denial-of-service condition on the affected host.

The flaw stems from improper boundary checks when parsing content inside Mach-O files. Cisco published the advisory covering this weakness, which is tracked as [CWE-125] Out-of-Bounds Read.

Critical Impact
A remote attacker can crash the ClamAV scanning engine without authentication or user interaction, disabling malware scanning on gateways, mail servers, and endpoints that rely on ClamAV.

Affected Products

ClamAV (Mach-O file format parser)
Cisco products that embed the affected ClamAV engine
Downstream distributions packaging vulnerable ClamAV versions

Discovery Timeline

2026-08-07 - CVE-2026-20347 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-20347

Vulnerability Analysis

The vulnerability resides in the ClamAV component that parses Mach-O executables, the native binary format used by macOS and iOS. During scanning, the parser reads structural fields from the Mach-O file to locate segments, sections, and load commands. The parser fails to validate that offset and size values fall within the actual file buffer.

When a crafted Mach-O file specifies malformed offsets or sizes, the parser reads memory outside the allocated buffer. This out-of-bounds read triggers memory corruption and terminates the clamd scanning process. The advisory notes that impacts beyond denial of service are possible, though the primary observed outcome is a crash of the scanning engine.

Root Cause

The root cause is improper boundary checking [CWE-125] during Mach-O header and load command parsing. The parser trusts length and offset fields inside the file without confirming they remain within the file's actual byte range. This allows attacker-controlled values to drive read operations past the end of the parser's buffer.

Attack Vector

Exploitation requires only that the target ClamAV instance scan an attacker-supplied Mach-O file. Delivery paths include email attachments processed by mail gateways, uploaded files scanned by web application scanners, and files placed in monitored directories. No authentication or user interaction is required, and the attack traverses the network to reach any service that invokes ClamAV on untrusted content.

No public proof-of-concept exploit is available for this issue. Refer to the Cisco Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-20347

Indicators of Compromise

Unexpected termination or repeated restarts of the clamd daemon or clamscan process on scanning hosts
Segmentation fault entries for ClamAV processes in system logs (/var/log/messages, journalctl, or dmesg)
Inbound Mach-O files (magic bytes 0xFEEDFACE, 0xFEEDFACF, 0xCAFEBABE) arriving from untrusted sources
Gaps in scanning telemetry corresponding to crash events on mail or file gateways

Detection Strategies

Monitor process supervisors and init systems for abnormal exit codes from clamd, especially SIGSEGV or SIGABRT.
Alert on ClamAV log entries containing parser errors referencing Mach-O, cli_machoheader, or cli_scanmacho.
Correlate scanning failures with the hash and origin of the file being processed to identify the triggering sample.

Monitoring Recommendations

Ingest ClamAV daemon logs and host process telemetry into a centralized analytics pipeline for crash pattern analysis.
Track scan queue depth and failure rates on mail gateways to detect scanning outages caused by repeated crashes.
Retain suspicious Mach-O samples that trigger scanner crashes for offline analysis and signature development.

How to Mitigate CVE-2026-20347

Immediate Actions Required

Apply the fixed ClamAV release referenced in the Cisco Security Advisory as soon as it is available for your platform.
Inventory all systems running ClamAV, including embedded appliances, mail relays, and container images.
Configure service managers to automatically restart clamd after abnormal termination to reduce scanning downtime while patching is in progress.

Patch Information

Cisco has published a security advisory for this vulnerability. Consult the Cisco Security Advisory for fixed version numbers and upgrade guidance for ClamAV and Cisco products that embed the engine. Update downstream distribution packages once vendor-rebuilt versions are released.

Workarounds

Disable Mach-O scanning in the ClamAV configuration if the environment does not process macOS or iOS binaries.
Restrict inbound file types at the perimeter to block Mach-O binaries from untrusted sources until patching completes.
Isolate scanning hosts from direct exposure to untrusted networks and place them behind protocol-aware proxies.

bash

# Configuration example: disable Mach-O scanning in clamd.conf
# /etc/clamav/clamd.conf
ScanMachO no

# Reload the daemon after modifying configuration
sudo systemctl restart clamav-daemon

# Confirm the setting took effect
clamconf | grep -i macho