A high-severity double free vulnerability in the ClamAV component of Cisco Secure Endpoint enables unauthenticated, remote attackers to crash the service, leading to potential denial of service.

The flaw exists in the zip archive parser and is caused by a double free memory error (CWE-415). An unauthenticated, remote attacker can exploit this via specially crafted files to cause a service crash.

Successful exploitation results in a denial of service, which disrupts the protective capabilities of the Cisco Secure Endpoint agent. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to endpoint security posture, potentially leaving systems vulnerable to other threats while the security software is unresponsive.

Immediate Action: Review the official Cisco security advisory at the link provided in the enrichment data and apply the recommended software updates to move beyond the affected versions.

Proactive Monitoring: Monitor system logs for unexpected crashes or restarts of the Cisco Secure Endpoint service.

Compensating Controls: Ensure that network-level traffic inspection is active to identify and block malformed zip archives before they reach the endpoint agent.

Public Exploit Available: No

The reliance on a vulnerable library within security software creates a critical availability risk. Administrators should prioritize patching these specific versions of Cisco Secure Endpoint immediately to restore full service stability and security integrity.