ClamAV, the popular open-source antivirus engine, has released version 1.5.4, addressing eight vulnerabilities in its file parsers, archive handlers, and unpacking components.
Among the issues fixed in ClamAV 1.5.4 is CVE-2026-20337, a flaw in ZIP catalog capacity tracking that could cause a write beyond a heap allocation as indexing local file headers. Another 1.5-specific issue, CVE-2026-20338, concerns incorrect ownership handling during the merging of ZIP catalog records.
ClamAV 1.5.4 also fixes CVE-2026-20345, an indexing problem during conversion of GPT partition names that could cause reads or writes beyond a stack-allocated partition entry. In addition, an older issue, CVE-2026-20339, has been addressed in the PESpin unpacker.
The PDF parser also receives a security fix addressing CVE-2026-20346, an integer underflow that could cause ClamAV to crash when processing a malformed hexadecimal string inside a PDF document. Meanwhile, CVE-2026-20347 addresses undefined behavior and an integer overflow in the Mach-O parser.
Another parser-related fix concerns CVE-2026-20348 in ClamAV’s XAR support. Incorrect size handling while decompressing a malformed table of contents could cause the scanner to request an excessively large memory allocation or exceed scanning limits.
The eighth vulnerability, CVE-2025-8088, is handled by incorporating an upstream fix from the UnRAR project into ClamAV’s bundled UnRAR library.
Beyond those eight CVEs, ClamAV 1.5.4 resolves thread-safety problems in the clamd STATS command. During concurrent scans and STATS requests, the flaw could expose process memory or cause the daemon to crash. Handling of partial socket writes for large STATS responses has also been fixed.
FreeBSD users get restored support for safely moving or removing quarantined files while retaining protections against race conditions in which an attacker could replace the original source path during the operation.
Finally, the Rust crossbeam-epoch dependency has been upgraded to address the RUSTSEC-2026-0204 advisory.
Alongside ClamAV 1.5.4, the project released ClamAV 1.4.6 for users on the older branch. It includes fixes for six of the eight CVEs addressed in 1.5.4, plus the clamd STATS issue, FreeBSD quarantine fix, UnRAR correction, and updated Rust dependency.
For additional details, see the announcement. ClamAV 1.5.4 and 1.4.6 are available from the project’s official download page and GitHub releases, while updated Alpine- and Debian-based Docker images are also being published on Docker Hub.
