CVE-2026-20031

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-248

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 4, 2026
Last modified
Jun 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-200324.4A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escapeCVE-2026-200337.4A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial oCVE-2026-200348.8A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbCVE-2026-200357.2A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks thCVE-2026-200366.5A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker wiCVE-2026-200374.4A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only CVE-2026-200385.8A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unaCVE-2026-200398.6A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DCVE-2026-20048.8Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbiCVE-2026-200408.8A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on thCVE-2026-200416.1A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a serCVE-2026-200426.5A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and acc
CVE-2026-20031: Medium severity, CVSS 5.3 | Vulnix