On August 7, corrective releases of the free antivirus package were published ClamAV 1.5.4 and 1.4.6. The main focus of the new versions is security: eight CVEs have been closed in the current branch 1.5, six of which have also been fixed in the supported branch 1.4. Additionally, an issue in clamd that could lead to the disclosure of process memory content has been resolved.
In ClamAV 1.5.4 the following vulnerabilities have been fixed:
- CVE-2026-20337 — a ZIP directory size accounting error could lead to writing beyond the allocated heap buffer when indexing local file headers. Versions of ClamAV 1.5.0–1.5.3 are vulnerable.
- CVE-2026-20338 — a memory management error during ZIP directory entry merging could lead to incorrect memory release when processing a specially crafted archive. This also affected only the 1.5 branch.
- CVE-2026-20345 — an indexing error in GPT partition name transformation allowed reading or writing data beyond the partition structure placed on the stack. The issue has existed since ClamAV 0.98.2.
- CVE-2026-20339 — an integer overflow in the PESpin unpacker could lead to allocating too small a buffer, followed by writing beyond its limits when restoring a PE file. The vulnerability existed since ClamAV 0.90.
- CVE-2026-20346 — a downwards integer overflow in the PDF parser could cause the process to crash when reading an incorrect hexadecimal string.
- CVE-2026-20347 — an integer overflow and undefined behavior in the Mach-O parser could lead to the scanner crashing when checking a specially crafted file.
- CVE-2026-20348 — size validation errors in the XAR parser allowed triggering excessive memory allocation or exceeding established scan limits when unpacking a corrupted content table.
- CVE-2025-8088 — an upstream fix has been carried over to the UnRAR library included with ClamAV. On Windows, path separators within NTFS alternate data stream names could allow data extraction beyond ClamAV's temporary directory.
In ClamAV 1.4.6 fixed six of the listed vulnerabilities: CVE-2026-20345, CVE-2026-20339, CVE-2026-20346, CVE-2026-20347, CVE-2026-20348 and CVE-2025-8088. Two ZIP handler issues — CVE-2026-20337 and CVE-2026-20338 — relate to code in the 1.5 branch and are therefore not relevant for 1.4.
Separately, developers have resolved a long-standing thread safety issue in the team clamd STATS. When scanning and statistics requests were performed simultaneously, a race condition could lead to the exposure of data from the process's memory or the daemon's crash. This bug existed in ClamAV since version 0.95. The handling of partial writes to the socket when sending large STATS responses has also been fixed. The fix has been included in both new versions.
Safe operation of quarantine moving and file deletion operations is working again for FreeBSD. In version 1.5.4, an OpenSSL context leakage was additionally fixed while using deprecated hashing functions in some configurations, particularly when the standard provider was unavailable in a FIPS-compliant environment. In both branches, the Rust dependency crossbeam-epoch has been updated to eliminate warnings. RUSTSEC-2026-0204.
ClamAV is a cross-platform free antivirus suite and a set of libraries for detecting malware, widely used in Linux and mail servers. The project is distributed under the license GNU GPLv2.
Source: linux.org.ru
