CVE-2026-20031 — Uncaught Exception in Cisco Secure Endpoint

CWE-248 — Uncaught Exception5 documents5 sources

Severity

5.3MEDIUMNVD

EPSS

0.1%

top 66.90%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Secure Endpoint

Timeline

PublishedMar 4

Description

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5cisco/cisco_secure_endpoint162 versions+161

🔴Vulnerability Details

GHSA

GHSA-hvpm-hv6g-6m5c: A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service↗2026-03-04

▶

CVEList

ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability↗2026-03-04

▶

📋Vendor Advisories

Cisco

ClamAV Cascading Style Sheets Image Parsing Error Handling Denial of Service Vulnerability↗2026-03-04

▶

🕵️Threat Intelligence

Wiz

CVE-2026-20031 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶