ClamAV 1.5.4

ClamAV 1.5.4 is a patch release with the following fixes:

• CVE-2026-20337:
  Fixed ZIP catalogue capacity tracking that could write beyond a heap
  allocation while indexing local file headers.

  This issue affects ClamAV 1.5.0 through 1.5.3.
  The fix is included in 1.5.4.

  Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying
  this issue.

• CVE-2026-20345:
  Fixed an indexing error while converting GPT partition names that could
  read or write beyond a stack-allocated partition entry.

  This issue affects ClamAV 0.98.2 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
  of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20339:
  Fixed an integer overflow in the PESpin unpacker that could allocate an
  undersized buffer and then write beyond it while rebuilding a PE file.

  This issue affects ClamAV 0.90 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Feng Xue and, independently, Yazdan Soltani for identifying
  this issue.

• CVE-2026-20338:
  Fixed ownership handling while merging ZIP catalogue records that could
  cause an invalid free while scanning a malformed archive.

  This issue affects ClamAV 1.5.0 through 1.5.3.
  The fix is included in 1.5.4.

  Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for
  identifying this issue.

• CVE-2026-20346:
  Fixed an integer underflow in the PDF parser that could cause a crash while
  reading a malformed hex string.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
  1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20347:
  Fixed undefined behavior and integer overflow in the Mach-O parser that
  could cause a crash while scanning a malformed Mach-O file.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
  1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20348:
  Fixed XAR parser size handling that could request an excessive allocation
  or exceed scan limits while decompressing a malformed table of contents.

  This issue affects ClamAV 0.98.1 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to leduckhuong for identifying this issue.

• CVE-2025-8088:
  Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
  The fix rejects path separators in NTFS alternate data stream names to
  prevent extraction outside ClamAV's temporary scan directory on Windows.

  This issue affects ClamAV 0.101.0 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.

• Fixed thread-safety issues in the clamd STATS command that could disclose
  process memory or crash the daemon while scans and STATS requests run
  concurrently. Also fixed partial socket-write handling used for large STATS
  responses.

  This issue affects ClamAV 0.95 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

• FreeBSD: Restored support for safe quarantine move and remove actions while
  preserving protection against source-path replacement races.

  This issue affects ClamAV 1.4.5 and 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

• Fixed an OpenSSL library-context leak in legacy hashing helpers when a
  requested message digest cannot be fetched, such as when the default
  provider is unavailable in a FIPS-enabled environment.

  This issue affects ClamAV 1.5.0 through 1.5.3.
  The fix is included in 1.5.4.

• Upgraded the Rust crossbeam-epoch dependency to resolve the
  RUSTSEC-2026-0204 advisory.

ClamAV 1.4.6

ClamAV 1.4.6 is a patch release with the following fixes:

• CVE-2026-20345:
  Fixed an indexing error while converting GPT partition names that could
  read or write beyond a stack-allocated partition entry.

  This issue affects ClamAV 0.98.2 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
  of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20339:
  Fixed an integer overflow in the PESpin unpacker that could allocate an
  undersized buffer and then write beyond it while rebuilding a PE file.

  This issue affects ClamAV 0.90 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Feng Xue and, independently, Yazdan Soltani for identifying
  this issue.

• CVE-2026-20346:
  Fixed an integer underflow in the PDF parser that could cause a crash while
  reading a malformed hex string.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
  1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20347:
  Fixed undefined behavior and integer overflow in the Mach-O parser that
  could cause a crash while scanning a malformed Mach-O file.

  This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
  1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Tristan (@TristanInSec) for identifying this issue.

• CVE-2026-20348:
  Fixed XAR parser size handling that could request an excessive allocation
  or exceed scan limits while decompressing a malformed table of contents.

  This issue affects ClamAV 0.98.1 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to leduckhuong for identifying this issue.

• CVE-2025-8088:
  Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
  The fix rejects path separators in NTFS alternate data stream names to
  prevent extraction outside ClamAV's temporary scan directory on Windows.

  This issue affects ClamAV 0.101.0 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

  Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.

• Fixed thread-safety issues in the clamd STATS command that could disclose
  process memory or crash the daemon while scans and STATS requests run
  concurrently. Also fixed partial socket-write handling used for large STATS
  responses.

  This issue affects ClamAV 0.95 through 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

• FreeBSD: Restored support for safe quarantine move and remove actions while
  preserving protection against source-path replacement races.

  This issue affects ClamAV 1.4.5 and 1.5.3.
  The fix is included in 1.4.6 and 1.5.4.

• Upgraded the Rust crossbeam-epoch dependency to resolve the
  RUSTSEC-2026-0204 advisory.

ClamAV 1.5.3

ClamAV 1.5.3 is a patch release with the following fixes:

• CVE-2026-20217:
  Fixed a bug in the PESpin unpacker cleanup path that could free pointers
  into the scanned file buffer and crash the scanner.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2005.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
  of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20213:
  Fixed an integer overflow in PE rebuild size calculations that could be
  reached through a malformed Aspack-packed PE file and lead to a heap buffer
  overflow write.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2007.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20216:
  Fixed an InstallShield archive extraction limit bypass that could write far
  more temporary data than intended and exhaust temporary storage.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2009.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Mizu for identifying this issue.

• CVE-2026-20214:
  Fixed an FSG unpacker loop underflow that could write past the section array
  while scanning a malformed PE file.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2004.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20243:
  Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
  to panic, abort the scanner, or skip expected scan-limit handling.

  This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Yazdan Soltani for identifying this issue.

• CVE-2026-20215:
  Fixed a 7z parser substream count overflow that could under-allocate parser
  metadata arrays and write past them while reading a malformed archive.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20244:
  Fixed 32-bit DMG parser size checks that could let a short mish stripe table
  pass validation and crash 32-bit scanner builds.

  This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including
  1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit
  builds.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Stanley John Tobias for identifying this issue.

• Hardened clamscan, clamdscan, and clamonacc quarantine actions against
  time-of-check/time-of-use races that could redirect copied, moved, or removed
  files under unsafe quarantine directory configurations.

  Thank you to Hiroki Imai from Ricerca Security, Inc. for identifying this
  issue.

• Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
  RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
  resolve CVE-2026-41676.

• Raised the minimum required CMake version to 3.17 to fix Linux builds with
  libcurl v8.21.0 when linking static library dependencies.

• Metadata preclass scans now run before the final scan verdict.

• ClamOnAcc: Fixed errors when recursively excluded paths are children of an
  included path.

• ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
  in the same bucket.

  These fixes are courtesy of sharkautarch.

ClamAV 1.4.5

ClamAV 1.4.5 is a patch release with the following fixes:

• CVE-2026-20217:
  Fixed a bug in the PESpin unpacker cleanup path that could free pointers
  into the scanned file buffer and crash the scanner.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2005.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
  of Tencent Xuanwu Lab for identifying this issue.

• CVE-2026-20213:
  Fixed an integer overflow in PE rebuild size calculations that could be
  reached through a malformed Aspack-packed PE file and lead to a heap buffer
  overflow write.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2007.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20216:
  Fixed an InstallShield archive extraction limit bypass that could write far
  more temporary data than intended and exhaust temporary storage.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2009.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Mizu for identifying this issue.

• CVE-2026-20214:
  Fixed an FSG unpacker loop underflow that could write past the section array
  while scanning a malformed PE file.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
  as 2004.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20243:
  Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
  to panic, abort the scanner, or skip expected scan-limit handling.

  This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Yazdan Soltani for identifying this issue.

• CVE-2026-20215:
  Fixed a 7z parser substream count overflow that could under-allocate parser
  metadata arrays and write past them while reading a malformed archive.

  This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
  this issue.

• CVE-2026-20244:
  Fixed 32-bit DMG parser size checks that could let a short mish stripe table
  pass validation and crash 32-bit scanner builds.

  This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including
  1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit
  builds.
  The fix is included in 1.5.3 and 1.4.5.

  Thank you to Stanley John Tobias for identifying this issue.

• Hardened clamscan, clamdscan, and clamonacc quarantine actions against
  time-of-check/time-of-use races that could redirect copied, moved, or removed
  files under unsafe quarantine directory configurations.

  Thank you to Hiroki Imai from Ricerca Security, Inc. for identifying this
  issue.

• Raised the minimum required CMake version to 3.17 to fix Linux builds with
  libcurl v8.21.0 when linking static library dependencies.

• ClamOnAcc: Fixed errors when recursively excluded paths are children of an
  included path.

  This fix is courtesy of sharkautarch.

ClamAV 1.5.2

ClamAV 1.5.2 is a patch release with the following fixes:

• CVE-2026-20031:
  Fixed an error handling bug in the HTML file parser that may crash the program
  and cause a denial-of-service (DoS) condition.

  This issue was introduced in version 1.1.0.
  The fix is included in 1.5.2 and 1.4.4.

• Fixed a possible infinite loop when scanning some JPEG files by upgrading
  affected ClamAV dependency, a Rust image library.

  Unfortunately, this change requires a newer Rust compiler for ClamAV.
  The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
  The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.

• Fixed a possible crash on Windows when scanning some files while using the
  LeaveTemporaryFiles and TemporaryDirectory features.

• The CVD verification process will now ignore certificate files in the CVD
  certs directory when the user lacks read permissions.

• Freshclam: Fixed CLD verification bug with PrivateMirror option.

• Upgraded the Rust bytes dependency to a newer version to resolve the
  RUSTSEC-2026-0007 advisory.

• Fixed a possible crash caused by invalid pointer alignment on some platforms.
  This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.

ClamAV 1.4.4

ClamAV 1.4.4 is a patch release with the following fixes:

• CVE-2026-20031:
  Fixed an error handling bug in the HTML file parser that may crash the program
  and cause a denial-of-service (DoS) condition.

  This issue was introduced in version 1.1.0.
  The fix is included in 1.5.2 and 1.4.4.

• Fixed a possible crash when scanning some TIFF files by upgrading the
  affected ClamAV dependency, a Rust image library.

  Unfortunately, this change requires a newer Rust compiler for ClamAV.
  The minimum Rust version for ClamAV 1.4.3 was 1.70.0.
  The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.

• Upgraded the Rust bytes dependency to a newer version to resolve the
  RUSTSEC-2026-0007 advisory.

• Fixed a possible crash caused by invalid pointer alignment on some platforms.
  This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.

ClamAV 1.5.1

ClamAV 1.5.1 is a patch release with the following fixes:

• Fixed a significant performance issue when scanning some PE files.

• Fixed an issue recording file entries from a ZIP archive central directory
  which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
  ClamScan --alert-exceeds-max command line option or ClamD AlertExceedsMax
  config file option.

• Improved performance when scanning TNEF email attachments.

• Fixed an issue with recording metadata for OOXML office documents.

• Fixed an issue with signature matches for VBA in OLE2 office documents.

• Loosened overly restrictive rules for embedded file identification and
  increased the limit for finding PE files embedded in other PE files.

• Fixed an issue with extracting some RAR archives embedded in other files.

• Fixed an issue with calculating fuzzy hashes affecting some images by updating
  the version for several Rust library dependencies.

  • This release does not require a newer version of the Rust compiler toolchain
    than what was required for ClamAV 1.5.0.

GitHub pull request

ClamAV 1.5.0

ClamAV 1.5.0 includes the following improvements and changes:

Major changes

• Added checks to determine if an OLE2-based Microsoft Office document is
  encrypted.

  GitHub pull request

• Added the ability to record URIs found in HTML if the generate-JSON-metadata
  feature is enabled.
  Also adds an option to disable this in case you want the JSON metadata
  feature but do not want to record HTML URIs.
  The ClamScan command-line option is --json-store-html-uris=no.
  The clamd.conf config option is JsonStoreHTMLURIs no.
  The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URIS

  GitHub pull request #1

  GitHub pull request #2

  GitHub pull request #3

• Added the ability to record URIs found in PDFs if the generate-JSON-metadata
  feature is enabled.
  Also adds an option to disable this in case you want the JSON metadata
  feature but do not want to record PDF URIs.
  The ClamScan command-line option is --json-store-pdf-uris=no.
  The clamd.conf config option is JsonStorePDFURIs no.
  The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URIS

  GitHub pull request #1

  GitHub pull request #2

  GitHub pull request #3

  GitHub pull request #4

• Added regex support for the clamd.conf OnAccessExcludePath config option.
  This change courtesy of GitHub user b1tg.

  GitHub pull request

• Added CVD signing/verification with external .sign files.

  Freshclam will now attempt to download external signature files to accompany
  existing .cvd databases and .cdiff patch files. Sigtool now has commands
  to sign and verify using the external signatures.

  ClamAV now installs a 'certs' directory in the app config directory
  (e.g., <prefix>/etc/certs). The install path is configurable.
  The CMake option to configure the CVD certs directory is
  -D CVD_CERTS_DIRECTORY=PATH

  New options to set an alternative CVD certs directory:

  • The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is
    --cvdcertsdir PATH
  • The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is
    CVD_CERTS_DIR
  • The config option for Freshclam and ClamD is
    CVDCertsDirectory PATH

  Added two new APIs to the public clamav.h header:

  cl_error_t cl_cvdverify_ex(
      const char *file,
      const char *certs_directory,
      uint32_t dboptions);
  
  cl_error_t cl_cvdunpack_ex(
      const char *file,
      const char *dir,
      const char *certs_directory,
      uint32_t dboptions);

  The original cl_cvdverify and cl_cvdunpack are deprecated.

  Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
  You may set this option with cl_engine_set_str and get it with
  cl_engine_get_str, to override the compiled in default CVD certs directory.

  Thank you to Mark Carey at SAP for inspiring work on this feature with an
  initial proof of concept for external-signature FIPS compliant CVD signing.

  GitHub pull request #1

  GitHub pull request #2

  GitHub pull request #3

  GitHub pull request #4

• Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable FIPS-like
  limits disabling MD5 and SHA1 from being used for verifying digital signatures
  or for being used to trust a file when checking for false positives (FPs).

  For freshclam.conf and clamd.conf set this config option:

  FIPSCryptoHashLimits yes
  

  For clamscan and sigtool use this command-line option:

  --fips-limits
  

  For libclamav: Enable FIPS-limits for a ClamAV engine like this:

  cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);

  ClamAV will also attempt to detect if FIPS-mode is enabled. If so, it will
  automatically enable the FIPS-limits feature.

  This change mitigates safety concerns over the use of MD5 and SHA1 algorithms
  to trust files and is required to enable ClamAV to operate legitimately in
  FIPS-mode enabled environments.

  Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for detection
  purposes or for informational purposes in FIPS-enabled environments and when
  the FIPS-limits option is enabled.

  GitHub pull request

• Upgraded the clean-file scan cache to use SHA2-256 (prior versions use MD5).
  The clean-file cache algorithm is not configurable.

  This change resolves safety concerns over the use of MD5 to trust files and
  is required to enable ClamAV to operate legitimately in FIPS-mode enabled
  environments.

  GitHub pull request #1

  GitHub pull request #2

• ClamD: Added an option to disable select administrative commands including
  SHUTDOWN, RELOAD, STATS and VERSION.

  The new clamd.conf options are:

  EnableShutdownCommand yes
  EnableReloadCommand yes
  EnableStatsCommand yes
  EnableVersionCommand yes
  

  This change courtesy of GitHub user ChaoticByte.

  GitHub pull request

• libclamav: Added extended hashing functions with a "flags" parameter that
  allows the caller to choose if they want to bypass FIPS hash algorithm limits:

  cl_error_t cl_hash_data_ex(
      const char *alg,
      const uint8_t *data,
      size_t data_len,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);
  
  cl_error_t cl_hash_init_ex(
      const char *alg,
      uint32_t flags,
      cl_hash_ctx_t **ctx_out);
  
  cl_error_t cl_update_hash_ex(
      cl_hash_ctx_t *ctx,
      const uint8_t *data,
      size_t length);
  
  cl_error_t cl_finish_hash_ex(
      cl_hash_ctx_t *ctx,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);
  
  void cl_hash_destroy(void *ctx);
  
  cl_error_t cl_hash_file_fd_ex(
      const char *alg,
      int fd,
      size_t offset,
      size_t length,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);

  GitHub pull request

• ClamScan: Improved the precision of the bytes-scanned and bytes-read counters.
  The ClamScan scan summary will now report exact counts in "GiB", "MiB", "KiB",
  or "B" as appropriate. Previously, it always reported "MB".

  GitHub pull request

• ClamScan: Add hash & file-type in/out CLI options:

  • --hash-hint: The file hash so that libclamav does not need to calculate
    it. The type of hash must match the --hash-alg.
  • --log-hash: Print the file hash after each file scanned. The type of hash
    printed will match the --hash-alg.
  • --hash-alg: The hashing algorithm used for either --hash-hint or
    --log-hash. Supported algorithms are "md5", "sha1", "sha2-256".
    If not specified, the default is "sha2-256".
  • --file-type-hint: The file type hint so that libclamav can optimize
    scanning (e.g., "pe", "elf", "zip", etc.). You may also use ClamAV type names
    such as "CL_TYPE_PE". ClamAV will ignore the hint if it is not familiar with
    the specified type.
    See also: https://docs.clamav.net/appendix/FileTypes.html#file-types
  • --log-file-type: Print the file type after each file scanned.

  We will not be adding this for ClamDScan, as we do not have a mechanism in the
  ClamD socket API to receive scan options or a way for ClamD to include scan
  metadata in the response.

  GitHub pull request

• libclamav: Added new scan functions that provide additional functionality:

  cl_error_t cl_scanfile_ex(
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);
  
  cl_error_t cl_scandesc_ex(
      int desc,
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);
  
  cl_error_t cl_scanmap_ex(
      cl_fmap_t *map,
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);

  The older cl_scan*() functions are now deprecated and may be removed in a
  future release. See clamav.h for more details.

  GitHub pull request

• libclamav: Adde...

ClamAV 1.5.0-rc

ClamAV 1.5.0 includes the following improvements and changes:

Major changes

• Added checks to determine if an OLE2-based Microsoft Office document is
  encrypted.

  GitHub pull request

• Added the ability to record URIs found in HTML if the generate-JSON-metadata
  feature is enabled.
  Also adds an option to disable this in case you want the JSON metadata
  feature but do not want to record HTML URIs.
  The ClamScan command-line option is --json-store-html-uris=no.
  The clamd.conf config option is JsonStoreHTMLURIs no.
  The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URIS

  GitHub pull request #1

  GitHub pull request #2

  GitHub pull request #3

• Added the ability to record URIs found in PDFs if the generate-JSON-metadata
  feature is enabled.
  Also adds an option to disable this in case you want the JSON metadata
  feature but do not want to record PDF URIs.
  The ClamScan command-line option is --json-store-pdf-uris=no.
  The clamd.conf config option is JsonStorePDFURIs no.
  The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URIS

  GitHub pull request #1

  GitHub pull request #2

• Added regex support for the clamd.conf OnAccessExcludePath config option.
  This change courtesy of GitHub user b1tg.

  GitHub pull request

• Added CVD signing/verification with external .sign files.

  Freshclam will now attempt to download external signature files to accompany
  existing .cvd databases and .cdiff patch files. Sigtool now has commands
  to sign and verify using the external signatures.

  ClamAV now installs a 'certs' directory in the app config directory
  (e.g., <prefix>/etc/certs). The install path is configurable.
  The CMake option to configure the CVD certs directory is
  -D CVD_CERTS_DIRECTORY=PATH

  New options to set an alternative CVD certs directory:

  • The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is
    --cvdcertsdir PATH
  • The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is
    CVD_CERTS_DIR
  • The config option for Freshclam and ClamD is
    CVDCertsDirectory PATH

  Added two new APIs to the public clamav.h header:

  cl_error_t cl_cvdverify_ex(
      const char *file,
      const char *certs_directory,
      uint32_t dboptions);
  
  cl_error_t cl_cvdunpack_ex(
      const char *file,
      const char *dir,
      const char *certs_directory,
      uint32_t dboptions);

  The original cl_cvdverify and cl_cvdunpack are deprecated.

  Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
  You may set this option with cl_engine_set_str and get it with
  cl_engine_get_str, to override the compiled in default CVD certs directory.

  Thank you to Mark Carey at SAP for inspiring work on this feature with an
  initial proof of concept for external-signature FIPS compliant CVD signing.

  GitHub pull request #1

  GitHub pull request #2

  GitHub pull request #3

  GitHub pull request #4

• Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable FIPS-like
  limits disabling MD5 and SHA1 from being used for verifying digital signatures
  or for being used to trust a file when checking for false positives (FPs).

  For freshclam.conf and clamd.conf set this config option:

  FIPSCryptoHashLimits yes
  

  For clamscan and sigtool use this command-line option:

  --fips-limits
  

  For libclamav: Enable FIPS-limits for a ClamAV engine like this:

  cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);

  ClamAV will also attempt to detect if FIPS-mode is enabled. If so, it will
  automatically enable the FIPS-limits feature.

  This change mitigates safety concerns over the use of MD5 and SHA1 algorithms
  to trust files and is required to enable ClamAV to operate legitimately in
  FIPS-mode enabled environments.

  Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for detection
  purposes or for informational purposes in FIPS-enabled environments and when
  the FIPS-limits option is enabled.

  GitHub pull request

• Upgraded the clean-file scan cache to use SHA2-256 (prior versions use MD5).
  The clean-file cache algorithm is not configurable.

  This change resolves safety concerns over the use of MD5 to trust files and
  is required to enable ClamAV to operate legitimately in FIPS-mode enabled
  environments.

  GitHub pull request

• ClamD: Added an option to disable select administrative commands including
  SHUTDOWN, RELOAD, STATS and VERSION.

  The new clamd.conf options are:

  EnableShutdownCommand yes
  EnableReloadCommand yes
  EnableStatsCommand yes
  EnableVersionCommand yes
  

  This change courtesy of GitHub user ChaoticByte.

  GitHub pull request

• libclamav: Added extended hashing functions with a "flags" parameter that
  allows the caller to choose if they want to bypass FIPS hash algorithm limits:

  cl_error_t cl_hash_data_ex(
      const char *alg,
      const uint8_t *data,
      size_t data_len,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);
  
  cl_error_t cl_hash_init_ex(
      const char *alg,
      uint32_t flags,
      cl_hash_ctx_t **ctx_out);
  
  cl_error_t cl_update_hash_ex(
      cl_hash_ctx_t *ctx,
      const uint8_t *data,
      size_t length);
  
  cl_error_t cl_finish_hash_ex(
      cl_hash_ctx_t *ctx,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);
  
  void cl_hash_destroy(void *ctx);
  
  cl_error_t cl_hash_file_fd_ex(
      const char *alg,
      int fd,
      size_t offset,
      size_t length,
      uint8_t **hash,
      size_t *hash_len,
      uint32_t flags);

  GitHub pull request

• ClamScan: Improved the precision of the bytes-scanned and bytes-read counters.
  The ClamScan scan summary will now report exact counts in "GiB", "MiB", "KiB",
  or "B" as appropriate. Previously, it always reported "MB".

  GitHub pull request

• ClamScan: Add hash & file-type in/out CLI options:

  • --hash-hint: The file hash so that libclamav does not need to calculate
    it. The type of hash must match the --hash-alg.
  • --log-hash: Print the file hash after each file scanned. The type of hash
    printed will match the --hash-alg.
  • --hash-alg: The hashing algorithm used for either --hash-hint or
    --log-hash. Supported algorithms are "md5", "sha1", "sha2-256".
    If not specified, the default is "sha2-256".
  • --file-type-hint: The file type hint so that libclamav can optimize
    scanning (e.g., "pe", "elf", "zip", etc.). You may also use ClamAV type names
    such as "CL_TYPE_PE". ClamAV will ignore the hint if it is not familiar with
    the specified type.
    See also: https://docs.clamav.net/appendix/FileTypes.html#file-types
  • --log-file-type: Print the file type after each file scanned.

  We will not be adding this for ClamDScan, as we do not have a mechanism in the
  ClamD socket API to receive scan options or a way for ClamD to include scan
  metadata in the response.

  GitHub pull request

• libclamav: Added new scan functions that provide additional functionality:

  cl_error_t cl_scanfile_ex(
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);
  
  cl_error_t cl_scandesc_ex(
      int desc,
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);
  
  cl_error_t cl_scanmap_ex(
      cl_fmap_t *map,
      const char *filename,
      cl_verdict_t *verdict_out,
      const char **last_alert_out,
      uint64_t *scanned_out,
      const struct cl_engine *engine,
      struct cl_scan_options *scanoptions,
      void *context,
      const char *hash_hint,
      char **hash_out,
      const char *hash_alg,
      const char *file_type_hint,
      char **file_type_out);

  The older cl_scan*() functions are now deprecated and may be removed in a
  future release. See clamav.h for more details.

  GitHub pull request

• libclamav: Added a new engine option to toggle temp directory recursion.

  Temp directory recursion is the idea that each object scanned in ClamAV's
  recursive extract/scan process will get a new temp subdirectory, mimicking
  the nesting structure ...

ClamAV 1.4.3

ClamAV 1.4.3 is a patch release with the following fixes:

• CVE-2025-20260:
  Fixed a possible buffer overflow write bug in the PDF file parser that could
  cause a denial-of-service (DoS) condition or enable remote code execution.

  This issue only affects configurations where both:

  1. The max file-size scan limit is set greater than or equal to 1024MB.
  2. The max scan-size scan limit is set greater than or equal to 1025MB.

  The code flaw was present prior to version 1.0.0, but a change in version
  1.0.0 that enables larger allocations based on untrusted data made it
  possible to trigger this bug.

  This issue affects all currently supported versions. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to Greg Walkup at Sandia National Labs for identifying this issue.

• CVE-2025-20234:
  Fixed a possible buffer overflow read bug in the UDF file parser that may
  write to a temp file and thus disclose information, or it may crash and
  cause a denial-of-service (DoS) condition.

  This issue was introduced in version 1.2.0. It will be fixed in 1.4.3.

  Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero
  Day Initiative, for identifying this issue.

• Fixed a possible use-after-free bug in the Xz decompression module in the
  bundled lzma-sdk library.

  This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy
  of the lzma-sdk with some performance changes specific to libclamav, plus
  select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.

  This issue affects all ClamAV versions at least as far back as 0.99.4.
  It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to OSS-Fuzz for identifying this issue.

• Windows: Fixed a build install issue when a DLL dependency such as libcrypto
  has the exact same name as one provided by the Windows operating system.