A flaw in the ZIP file parser of ClamAV allows an unauthenticated, remote attacker to trigger an out‑of‑bounds memory write when the malware‑aware engine processes a crafted archive. The resulting crash terminates the scanning process, preventing any further antivirus activity on the affected device. This boundary‑check failure is a classic buffer overflow classified as CWE‑120.

The vulnerability is located in the ClamAV component bundled with Cisco Secure Endpoint, as identified by Cisco. While the advisory does not list specific versions, any deployment that uses the supplied ClamAV library is potentially impacted.

The CVSS score of 7.5 reflects a high‑severity vulnerability. Though no EPSS value is provided, the flaw can be triggered remotely without authentication by supplying a malicious ZIP file. The issue is not yet listed in the CISA KEV catalog, yet its remote trigger and the likelihood of widespread use of the affected repository make timely remediation prudent.