CVE-2026-20346
A remote, anonymous attacker can exploit multiple vulnerabilities in ClamAV to perform a Denial of Service attack and disclose information.
CSIRTS triage
- What
- Multiple vulnerabilities allow remote attackers to conduct denial of service and disclose information in ClamAV.
- Who is affected
- All ClamAV deployments, including email gateways and mail servers using ClamAV, are exposed to remote attack.
- Urgency
- High severity with remote exploitability and multiple CVEs; commonly deployed in critical infrastructure.
- Action
- Update ClamAV to patched version and verify virus definitions are current after patching.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-20346
Get an email if CVE-2026-20346 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Advisory coverage (6)
- highClamAV Vulnerabilities Affecting Cisco Products: August 2026cisco-psirt · 2026-08-13
- unknownexploitedCisco Products Multiple Vulnerabilitieshkcert · 2026-08-12
- high[NEW] [high] ClamAV: Multiple vulnerabilities allow Denial of Service and disclosure of informationcert-bund · 2026-08-11
- highCVE-2026-20346: ClamAV PDF File Format Processing Memory Corruption Vulnerabilitymsrc · 2026-08-11
- unknownexploitedMultiple vulnerabilities in ClamAV (August 10, 2026)cert-fr-avis · 2026-08-10
- highCVE-2026-20346: A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote…nvd · 2026-08-07
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-20346)