ClamAV 1.5.4 and 1.4.6 security patch versions published

Today, we are publishing the 1.5.4 and 1.4.6 security patch versions.  

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 

1.5.4

ClamAV 1.5.4 is a patch release with the following fixes:

• CVE-2026-20337: Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers.

  This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.

  Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue.

• CVE-2026-20345: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry.

  This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20339: Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file.

  This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue.

• CVE-2026-20338: Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive.

  This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.

  Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for identifying this issue.

• CVE-2026-20346: Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20347: Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20348: Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents.

  This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to leduckhuong for identifying this issue.

• CVE-2025-8088: Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

  This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.

  This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.

  This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4.

• Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment.

  This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.

• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

1.4.6

ClamAV 1.4.6 is a patch release with the following fixes:

• CVE-2026-20345: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry.

  This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20339: Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file.

  This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue.

• CVE-2026-20346: Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20347: Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20348: Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents.

  This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to leduckhuong for identifying this issue.

• CVE-2025-8088: Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows.

  This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

  Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.

• Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses.

  This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.

• FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races.

  This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4.

• Upgraded the Rust crossbeam-epoch dependency to resolve the RUSTSEC-2026-0204 advisory.

ClamAV 1.5.3 and 1.4.5 security patch versions published

Today, we are publishing the 1.5.3 and 1.4.5 security patch versions.  

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 

1.5.3 

ClamAV 1.5.3 is a patch release with the following fixes:

• CVE-2026-20217: Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2005. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20213: Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2007. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20216: Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2009. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Mizu for identifying this issue.

• CVE-2026-20214: Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2004. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20243: Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.

  This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Yazdan Soltani for identifying this issue.

• CVE-2026-20215: Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20244: Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.

  This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including 1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit builds. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Stanley John Tobias for identifying this issue.

• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.

  Thank you to Hiroki Imai from Ricerca Security, Inc. for identifying this issue.

• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to resolve CVE-2026-41676.

• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.

• Metadata preclass scans now run before the final scan verdict.

• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.

• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in the same bucket.

  These fixes are courtesy of sharkautarch.

1.4.5 

ClamAV 1.4.5 is a patch release with the following fixes:

• CVE-2026-20217: Fixed a bug in the PESpin unpacker cleanup path that could free pointers into the scanned file buffer and crash the scanner.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2005. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20213: Fixed an integer overflow in PE rebuild size calculations that could be reached through a malformed Aspack-packed PE file and lead to a heap buffer overflow write.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2007. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20216: Fixed an InstallShield archive extraction limit bypass that could write far more temporary data than intended and exhaust temporary storage.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2009. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Mizu for identifying this issue.

• CVE-2026-20214: Fixed an FSG unpacker loop underflow that could write past the section array while scanning a malformed PE file.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as 2004. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20243: Fixed ALZ parser size handling bugs that could cause malformed ALZ archives to panic, abort the scanner, or skip expected scan-limit handling.

  This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Yazdan Soltani for identifying this issue.

• CVE-2026-20215: Fixed a 7z parser substream count overflow that could under-allocate parser metadata arrays and write past them while reading a malformed archive.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying this issue.

• CVE-2026-20244: Fixed 32-bit DMG parser size checks that could let a short mish stripe table pass validation and crash 32-bit scanner builds.

  This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including 1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit builds. The fix is included in 1.5.3 and 1.4.5.

  Thank you to Stanley John Tobias for identifying this issue.

• Hardened clamscan, clamdscan, and clamonacc quarantine actions against time-of-check/time-of-use races that could redirect copied, moved, or removed files under unsafe quarantine directory configurations.

  Thank you to Hiroki Imai from Ricerca Security, Inc. for identifying this issue.

• Raised the minimum required CMake version to 3.17 to fix Linux builds with libcurl v8.21.0 when linking static library dependencies.

• ClamOnAcc: Fixed errors when recursively excluded paths are children of an included path.

  This fix is courtesy of sharkautarch.

ClamAV 1.5.2 and 1.4.4 security patch versions published

Today, we are publishing the 1.5.2 and 1.4.4 security patch versions.  

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 

1.5.2 

ClamAV 1.5.2 is a patch release with the following fixes: 

• CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. 
• Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image library.  
• Unfortunately, this change requires a newer Rust compiler for ClamAV. 
  The minimum Rust version for ClamAV 1.4.3 was 1.85.1. 
  The minimum Rust version for ClamAV 1.4.4 is now 1.87.0. 
• Fixed a possible crash on Windows when scanning some files while using the LeaveTemporaryFiles and TemporaryDirectory features. 
• The CVD verification process will now ignore certificate files in the CVD certs directory when the user lacks read permissions. 
• Freshclam: Fix CLD verification bug with PrivateMirror option. 
• Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory. 
• Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT. 

1.4.4 

ClamAV 1.4.4 is a patch release with the following fixes: 

• CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a DoS condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4. 
• Fixed a possible crash when scanning some TIFF files by upgrading the affected ClamAV dependency, a Rust image library. 
• Unfortunately, this change requires a newer Rust compiler for ClamAV.
  The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
  The minimum Rust version for ClamAV 1.4.4 is now 1.87.0. 
• Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory. 
• Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT. 

  

ClamAV 1.5.1 patch version published

Today, we are publishing ClamAV 1.5.1.

This version has been released shortly after ClamAV 1.5.0 in order to address several significant issues that were identified following its publication.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day.

ClamAV 1.5.1 is a patch release with the following fixes:

• Fixed a significant performance issue when scanning some PE files

• Fixed an issue recording file entries from a ZIP archive central directory which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the ClamScan --alert-exceeds-max command line option or ClamD AlertExceedsMax config file option

• Improved performance when scanning TNEF email attachments

• Fixed an issue with recording metadata for OOXML office documents

• Fixed an issue with signature matches for VBA in OLE2 office documents

• Loosened overly restrictive rules for embedded file identification and increased the limit for finding PE files embedded in other PE files

• Fixed an issue with extracting some RAR archives embedded in other files

• Fixed an issue with calculating fuzzy hashes affecting some images by updating the version for several Rust library dependencies

  • This release does not require a newer version of the Rust compiler toolchain than what was required for ClamAV 1.5.0

GitHub pull request 

ClamAV 1.4.3 and 1.0.9 security patch versions published

Today, we are publishing the 1.4.3 and 1.0.9 security patch versions.

We have also added Linux aarch64 (aka ARM64) RPM and DEB installer packages for the 1.4 LTS release.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.

1.4.3

ClamAV 1.4.3 is a patch release with the following fixes: 

• CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.

  This issue only affects configurations where both:

  1. The max file-size scan limit is set greater than or equal to 1024MB.
  2. The max scan-size scan limit is set greater than or equal to 1025MB.

  The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.

  This issue affects all currently supported versions. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to Greg Walkup at Sandia National Labs for identifying this issue.

• CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition.

  This issue was introduced in version 1.2.0. It will be fixed in 1.4.3.

  Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero Day Initiative, for identifying this issue.

• Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.

  This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.

  This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to OSS-Fuzz for identifying this issue.

• Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.

1.0.9

ClamAV 1.0.9 is a patch release with the following fixes:

• CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.

  This issue only affects configurations where both:

  1. The max file-size scan limit is set greater than or equal to 1024MB.
  2. The max scan-size scan limit is set greater than or equal to 1025MB.

  The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.

  This issue affects all currently supported versions. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to Greg Walkup at Sandia National Labs for identifying this issue.

• Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.

  This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.

  This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to OSS-Fuzz for identifying this issue.

• Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.

ClamAV 1.4.2 and 1.0.8 security patch versions published

Today, we are publishing the 1.4.2 and 1.0.8 security patch versions. The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.

1.4.2

ClamAV 1.4.2 is a patch release with the following fixes: 

• CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.
  
  This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 and 1.0.8
  
  Thank you to OSS-Fuzz for identifying this issue.
  
  

1.0.8

ClamAV 1.0.8 is a patch release with the following fixes:

• CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.
  
  This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 and 1.0.8
  
  Thank you to OSS-Fuzz for identifying this issue.
  
  
• ClamOnAcc: Fixed an infinite loop when a watched directory does not exist. This is a backport of a fix from ClamAV 1.3.0.
• GitHub pull request

ClamAV 1.3.1, 1.2.3, 1.0.6 patch versions published

Today, we are publishing the 1.3.1, 1.2.3, and 1.0.6 security patch versions.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub.

The images on Docker Hub may not be immediately available on release day.

Continue reading to learn what changed in each version.

1.3.1

ClamAV 1.3.1 is a critical patch release with the following fixes:

• CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.

  This issue affects version 1.3.0 only and does not affect prior versions.

  Thank you to Błażej Pawłowski for identifying this issue.

  • GitHub pull request

• Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.

  • GitHub pull request

• Fixed a bug causing some text to be truncated when converting from UTF-16.

  • GitHub pull request

• Fixed assorted complaints identified by Coverity static analysis.

  • GitHub pull request

• Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.

  • GitHub pull request

• Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

  • GitHub pull request

• Added symbols to the libclamav.map file to enable additional build configurations.

  Patch courtesy of Neil Wilson.

  • GitHub pull request

1.2.3

ClamAV 1.2.3 is a critical patch release with the following fixes:

• Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.

  • GitHub pull request

• Fixed a bug causing some text to be truncated when converting from UTF-16.

  • GitHub pull request

• Fixed assorted complaints identified by Coverity static analysis.

  • GitHub pull request

• Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.

  • GitHub pull request

• Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

  • GitHub pull request

• Silenced a warning "Unexpected early end-of-file" that occured when scanning some PNG files.

  • GitHub pull request

1.0.6

ClamAV 1.0.6 is a critical patch release with the following fixes:

• Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.

  • GitHub pull request

• Fixed a bug causing some text to be truncated when converting from UTF-16.

  • GitHub pull request

• Fixed assorted complaints identified by Coverity static analysis.

  • GitHub pull request

• Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.

  • GitHub pull request

• Added the new 'valhalla' database name to the list of optional databases in preparation for future work.

  • GitHub pull request

• Silenced a warning "Unexpected early end-of-file" that occured when scanning some PNG files.

  • GitHub pull request