CVE-2026-20348

HIGH

ClamAV XAR File Format Processing Memory Corruption Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-20348 has a selected CVSS score of 7.5 (high); EIP currently links 1 curated repository PoC and 1 lab environment.

Description

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 7, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Cisco Secure Endpoint

Browse Cisco / Cisco Secure Endpoint

Default status: unknown

CVE List7.0.5affected
6.2.19affected
7.3.3affected
7.2.13affected
6.1.5affected
6.3.1affected
6.2.5affected
7.3.5affected
6.2.1affected
7.2.7affected
7.1.1affected
6.3.5affected
Showing 12 of 146 version ranges

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-20348Curated repository PoCby exploitintel8Exploit6 files

C · 22.3 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python 3 exploit for CVE-2026-20348 that crafts a malicious XAR file to trigger an out-of-bounds memory allocation in ClamAV's XAR parser, causing a denial-of-service via OOM kill. The script generates the payload, stages it in a Docker container, executes clamscan, and verifies the process was killed by SIGKILL.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2026-20348 consists of a Python script that generates a crafted XAR file and uses Docker to trigger a memory-exhaustion DoS in a vulnerable ClamAV container. The script performs only the described exploit behavior: it builds a XAR with a large declared TOC, stages it into a container, runs clamscan, and checks for an OOM-kill signal. No backdoor, concealed payload, or operator-directed harm is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareClamAV
Attack typesdenial-of-service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as an exploit because it contains code (poc/poc.py) that actively crafts a malicious input and executes it against a target to trigger a vulnerability, resulting in a denial-of-service condition. The README and verification report confirm its purpose is to exercise the vulnerability, not just detect it.

README.md:1poc/poc.py:1-3poc_verification_report.md:1

Requirements

  • A running Docker container of a vulnerable ClamAV version (<= 1.5.3) with a memory cap.poc/poc.py:99-105

Observed behavior

  • Crafts a XAR file with a header declaring a decompressed TOC size just under 1 GiB and a compressed TOC of ~1 MB.poc/poc.py:68-84
  • Stages the crafted XAR file and a minimal signature database into the target Docker container.poc/poc.py:122-129
  • Executes clamscan on the crafted file inside the container and checks for exit code 137 (SIGKILL) and the container's OOMKilled flag to confirm successful exploitation.poc/poc.py:134-158
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Docker Exec
Payload withheldThe PoC uses docker exec to run clamscan inside a lab container, which is the expected delivery mechanism for the DoS trigger.poc/poc.py:135-136
File Write
Payload withheldThe script writes a crafted XAR file to a temporary directory; this is the exploit payload generation, not a backdoor.poc/poc.py:68-84
Review boundaries

What the analysis did not establish

  • Evidence coverage is COMPLETE_FOR_READABLE_SELECTED_TEXT; 3 unclassified binary files totaling 7772 bytes were not analyzed.
  • The analysis is based solely on static review of the provided source code and documentation; the code was not executed.
  • Binary files (e.g., the crafted XAR) are not inspected; the review covers only the provided readable text.
  • The analysis does not verify the correctness or safety of the exploit against the target; it only assesses the PoC for backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2026-20348/docker-compose.yml

CVE-2026-20348Created Vuln labCVE-2026-20348Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A containerized lab for demonstrating CVE-2026-20348, a memory-exhaustion DoS in ClamAV's XAR parser. It uses two stock ClamAV images (vulnerable 1.5.3 and fixed 1.5.4) with a Python PoC that triggers an OOM kill on the vulnerable build.

CVE-2026-20348/README.md:1-106CVE-2026-20348/docker-compose.yml:1-24

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-20348), provides a PoC, and sets up vulnerable and control environments for reproduction. The compose file defines two services with profiles for vulnerable and control testing.

CVE-2026-20348/README.md:1-106CVE-2026-20348/docker-compose.yml:1-24
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

target

vulnerable ClamAV scanner

Service using clamav/clamav:1.5.3, the vulnerable version. It runs sleep infinity to keep the container alive for manual clamscan execution. A healthcheck verifies clamscan is available.

CVE-2026-20348/docker-compose.yml:2-12

control

patched ClamAV scanner

Service using clamav/clamav:1.5.4, the fixed version. It also runs sleep infinity and has a similar healthcheck. Used to confirm the PoC does not trigger the vulnerability on the patched build.

CVE-2026-20348/docker-compose.yml:14-24

poc.py

proof-of-concept exploit

Python script that generates a crafted XAR file, stages it into the target container, and runs clamscan with a 100 MiB scan-size limit. It determines success by checking for exit code 137 (SIGKILL) and the container's OOMKilled flag.

CVE-2026-20348/poc/poc.py:1-162
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-20348

Supported by supplied evidence

The lab explicitly targets CVE-2026-20348. The README, PoC script, and verification report all describe the vulnerability, its impact (OOM kill), and the fix. The compose file provides the exact vulnerable and fixed versions.

CVE-2026-20348/README.md:1-106CVE-2026-20348/poc/poc.py:1-162CVE-2026-20348/poc_verification_report.md:1-49
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab containers.CVE-2026-20348/README.md:72-82
  • Python 3 with standard library is required to execute the PoC script.CVE-2026-20348/README.md:84
  • The vulnerable target container must be started with the 'vulnerable' profile before running the PoC.CVE-2026-20348/README.md:75

Evidence-described exercise path

  1. Start the vulnerable target container using 'docker compose -p cve-2026-20348-pub-vuln --profile vulnerable up -d'.CVE-2026-20348/README.md:75
  2. Run the PoC against the vulnerable container: 'python3 poc/poc.py cve-2026-20348-pub-vuln'. The script generates a crafted XAR, copies it into the container, and executes clamscan. Expected result: [SUCCESS] with exit code 137.CVE-2026-20348/README.md:78CVE-2026-20348/poc/poc.py:1-162
  3. Start the control (patched) container using 'docker compose -p cve-2026-20348-pub-control --profile control up -d'.CVE-2026-20348/README.md:76
  4. Run the same PoC against the control container: 'python3 poc/poc.py cve-2026-20348-pub-control'. Expected result: [FAILED] with exit code 0 or 2.CVE-2026-20348/README.md:81
  5. Tear down the environments with 'docker compose -p <project> down -v'.CVE-2026-20348/README.md:83-84
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The PoC targets only the lab's own ClamAV container, causing an expected OOM kill within that container to demonstrate the vulnerability. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended DoS on the vulnerable service.

CVE-2026-20348/poc/poc.py:1-162CVE-2026-20348/README.md:1-106
Review boundaries

What the analysis did not establish

  • The packet does not include the files intel_brief.md and vulnerability_analysis.md referenced in the README, but their absence does not affect the analysis of the provided evidence.
  • The PoC script uses docker exec and docker cp, which require access to the Docker socket; this is a typical lab requirement but could be a concern if the lab were run in a shared environment without isolation.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2