ClamAV 1.5.4 is a patch release with the following fixes: CVE-2026-20337: Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue. CVE-2026-20345: Fixed an indexing error while…
ClamAV 1.4.6 is a patch release with the following fixes: CVE-2026-20345: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identify…
ClamAV 1.5.3 is a patch release with the following fixes: CVE-2026-20217: Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner. This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2005. The fix is included in 1.5.3 and 1.4.5. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen o…
ClamAV 1.4.5 is a patch release with the following fixes: CVE-2026-20217: Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner. This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2005. The fix is included in 1.5.3 and 1.4.5. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen o…
ClamAV 1.5.2 is a patch release with the following fixes: CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image l…
ClamAV 1.4.4 is a patch release with the following fixes: CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. Fixed a possible crash when scanning some TIFF files by upgrading the affected ClamAV dependency, a Rust image libra…
ClamAV 1.5.1 is a patch release with the following fixes: Fixed a significant performance issue when scanning some PE files. Fixed an issue recording file entries from a ZIP archive central directory which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the ClamScan --alert-exceeds-max command line option or ClamD AlertExceedsMax config file option. Improved performance when sc…
ClamAV 1.5.0 includes the following improvements and changes: Major changes Added checks to determine if an OLE2-based Microsoft Office document is encrypted. GitHub pull request Added the ability to record URIs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record HTML URIs. The Clam…
ClamAV 1.5.0 includes the following improvements and changes: Major changes Added checks to determine if an OLE2-based Microsoft Office document is encrypted. GitHub pull request Added the ability to record URIs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record HTML URIs. The Clam…
ClamAV 1.4.3 is a patch release with the following fixes: CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution. This issue only affects configurations where both: The max file-size scan limit is set greater than or equal to 1024MB. The max scan-size scan limit is set greater than or eq…
ClamAV 1.0.9 is a patch release with the following fixes: CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution. This issue only affects configurations where both: The max file-size scan limit is set greater than or equal to 1024MB. The max scan-size scan limit is set greater than or eq…
ClamAV 1.5.0 includes the following improvements and changes: Major changes Added checks to determine if an OLE2-based Microsoft Office document is encrypted. GitHub pull request Added the ability to record URLs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but don't want to record HTML URLs. The ClamS…
ClamAV 1.4.2 is a patch release with the following fixes: CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition. This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 1.0.8 Thank you to OSS-Fuzz for identifying this issue.
ClamAV 1.0.8 is a patch release with the following fixes: CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition. This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 1.0.8 Thank you to OSS-Fuzz for identifying this issue. ClamOnAcc: Fixed an infinite loop…