CVE-2022-20796: ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-04 · updated 2026-06-17
Weakness: CWE-822

Description

On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.

Affected products

Cisco Secure Endpoint: before 1.16.3; before 1.17.2; before 7.5.5; from 1.18.0 before 1.18.2 — fixed in 1.16.3, 1.17.2, 1.18.2, 7.5.5
Cisco ClamAV: 0.103.4, 0.103.5, 0.104.1, 0.104.2
Debian Linux: 9.0
Fedoraproject Fedora: 34, 35, 36

How to fix

Upgrade to a fixed version: Cisco Secure Endpoint 1.16.3, 1.17.2, 1.18.2, 7.5.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20796 or the next vulnerability affects your stack