CVE-2026-20348: cisco secure endpoint

csirt@kutim:~/threat-intel/cve/CVE-2026-20348

CVSS 7.5 · High EPSS 0,46%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada cisco secure endpoint. Skor CVSS 3.1 7.5 (High) menurut cisco.com.

Deskripsi (NVD)

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Rincian

Terbit di NVD: 7 Agustus 2026
Terakhir diubah: 19 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
EPSS (30 hari): 0,46% peluang dieksploitasi; lebih tinggi dari 38,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cisco	secure endpoint	Semua versi sebelum 1.27.4
cisco	secure endpoint	Semua versi sebelum 1.29.2
cisco	secure endpoint	Semua versi sebelum 7.5.24.21780
cisco	secure endpoint	Versi 8.0.0 hingga sebelum 8.6.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.