Loading story…
ClamAV released security patch versions 1.5.4 and 1.4.6 to fix seven vulnerabilities in the antivirus engine, along with additional stability issues affecting archive, partition, PDF, Mach-O, and PE parsing. The updates also incorporate an upstream UnRAR fix for CVE-2025-8088, resolve thread-safety problems in the clamd STATS command that could leak memory or crash the daemon, restore safe quarantine behavior on FreeBSD, and in 1.5.4 fix an OpenSSL library-context leak in legacy hashing helpers. Both releases also update the Rust crossbeam-epoch dependency to remediate RUSTSEC-2026-0204.
Advisories highlighted CVE-2026-20337 and CVE-2026-20338 as high-severity ZIP archive parser denial-of-service flaws caused by improper input validation during scanning, with public proof-of-concept code reportedly available. An unauthenticated remote attacker could submit crafted archives to disrupt scanning operations and affect service availability. Affected versions include ClamAV 1.5.x before 1.5.4 and 1.4.x before 1.4.6, while Cisco said related fixes also apply to Secure Endpoint Connector for Windows, Linux, and macOS and to Private Cloud 4.2.x before 4.2.8, with updated connector builds being released through August.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
ClamAV released versions 1.5.4 and 1.4.6 to remediate multiple vulnerabilities and stability issues, including seven CVEs in ClamAV itself, an upstream UnRAR fix for CVE-2025-8088, clamd STATS thread-safety flaws, and a FreeBSD quarantine fix.
Cisco released security updates addressing seven high-severity ClamAV vulnerabilities affecting ClamAV-based products, and highlighted that public proof-of-concept code exists for CVE-2026-20337 and CVE-2026-20338. The notice says affected products include ClamAV before 1.5.4 and 1.4.6, Secure Endpoint Connector builds before the August 2026 release, and Private Cloud 4.2.x before 4.2.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcesecurityweek.com
Open sourceacn.gov.it
Open sourceblog.clamav.net
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates for **Meeting Management**, **Secure Endpoint Connector** on Linux, macOS, and Windows, **Secure Endpoint Private Cloud**, and **BroadWorks** to remediate multiple vulnerabilities, including a critical flaw in Cisco Meeting Management tracked as `CVE-2025-20156`. The bug affects authorization validation in the REST API and allows an authenticated remote attacker to escalate privileges to administrator, potentially taking full control of managed nodes. Cisco also patched `CVE-2025-20165` in BroadWorks, where crafted SIP requests can trigger a denial of service. ClamAV separately published patch releases **1.4.2** and **1.0.8** to fix `CVE-2025-20128`, a parser flaw in OLE2 file handling that affects all currently supported versions since ClamAV 1.0.0 and was identified by **OSS-Fuzz**. Cisco said the same ClamAV issue affects Secure Endpoint products, where crafted files could disable the antivirus component, and noted that proof-of-concept exploit code is available. The ClamAV releases also address a **ClamOnAcc** stability problem that could cause an infinite loop when a watched directory does not exist.
Jul 24, 2026
A newly disclosed **7-Zip** vulnerability, tracked as `CVE-2026-14266`, allows remote code execution via a heap-based buffer overflow in the handling of crafted **XZ chunked data**. An attacker can trigger the flaw if a user opens a malicious archive or is lured to content that delivers a specially crafted XZ payload, causing code to run with the privileges of the current user. The issue is considered significant because 7-Zip is widely deployed and the attack path can be readily paired with phishing or malicious attachments. The bug was reported by Landon Peng of Lunbun LLC through coordinated disclosure, and the Zero Day Initiative published advisory **`ZDI-26-444`** after the fix became available. **7-Zip version 26.02**, released on June 25, 2026, contains the patch, and reporting said no public proof-of-concept or in-the-wild exploitation had been confirmed at publication. The flaw was assigned a **CVSS 7.0** score, reflecting the need for user interaction and a relatively complex exploit path, and users were urged to update and avoid opening untrusted compressed files.
Jul 24, 2026
GitHub Security Lab disclosed a set of vulnerabilities in **7-Zip** affecting archive and filesystem-image parsing, with the most serious issue tracked as **`CVE-2026-48095`** (`GHSL-2026-140`). The flaw is a **heap buffer write overflow** in NTFS compressed stream handling, specifically tied to edge-case parsing in `GetCuSize()`, and could potentially lead to arbitrary code execution when a crafted filesystem image is processed. A proof-of-concept described a malformed sparse NTFS disk image that abuses abnormal cluster sizing and compressed `$DATA` attributes to trigger the bug. The broader set of advisories also covered additional defects in parsing formats including **SquashFS, UEFI, UDF, WIM, 7z, and Ar**, as well as a **path traversal** issue in a sample application. According to reporting on the disclosures, **seven of eight** advisories in the set received CVE identifiers, and the issues were addressed in **7-Zip 26.01**. GitHub Security Lab also categorized the advisory pages in its AI-agent index as discoveries associated with AI-assisted research, though no specific agent was publicly identified.
Jul 20, 2026