A high-severity buffer overflow vulnerability in the Cisco Secure Endpoint ClamAV parser allows unauthenticated remote attackers to trigger a denial of service.

The vulnerability is a classic buffer overflow (CWE-120) located in the zip archive parser of ClamAV. An unauthenticated remote attacker can supply a maliciously crafted archive to cause the service to crash, resulting in a denial of service.

While the vulnerability only results in a denial of service, it impacts security infrastructure critical to identifying malicious files. The CVSS score of 7.5 reflects the high impact on service availability, which could leave an organization temporarily without malware protection, creating a window of opportunity for other attacks.

Immediate Action: Update Cisco Secure Endpoint to the latest patched version as provided in the official Cisco security advisory.

Proactive Monitoring: Monitor system logs for repeated service crashes or unexpected restarts of the ClamAV scanning engine.

Compensating Controls: Use network-level filtering to block suspicious zip archive files from reaching protected endpoints until the patch can be deployed.

Public Exploit Available: Unknown

Security teams should prioritize the deployment of the vendor-supplied update. Maintaining the integrity of endpoint protection software is essential, and resolving this denial of service vulnerability is necessary to prevent potential blind spots in security coverage.