ClamAV® blog

ClamAV 1.5.2 and 1.4.4 security patch versions published

2026-03-04T13:32:00.002-05:00

Today, we are publishing the 1.5.2 and 1.4.4 security patch versions.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.

1.5.2

ClamAV 1.5.2 is a patch release with the following fixes:

CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4.
Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image library.
Unfortunately, this change requires a newer Rust compiler for ClamAV.
The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.
Fixed a possible crash on Windows when scanning some files while using the LeaveTemporaryFiles and TemporaryDirectory features.
The CVD verification process will now ignore certificate files in the CVD certs directory when the user lacks read permissions.
Freshclam: Fix CLD verification bug with PrivateMirror option.
Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory.
Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.

1.4.4

ClamAV 1.4.4 is a patch release with the following fixes:

CVE-2026-20031: Fixed an error handling bug in the HTML file parser that may crash the program and cause a DoS condition. This issue was introduced in version 1.1.0. The fix is included in 1.5.2 and 1.4.4.
Fixed a possible crash when scanning some TIFF files by upgrading the affected ClamAV dependency, a Rust image library.
Unfortunately, this change requires a newer Rust compiler for ClamAV.
The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.
Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory.
Fixed a possible crash caused by invalid pointer alignment on some platforms. This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.

ClamAV Signature Retirement

2025-12-18T13:30:00.001-05:00

As per our previous announcement ClamAV file signature retirement has been implemented.
Users may notice that file sizes are much smaller today as a result of the signature retirements.
After we retired impacted signatures our download file sizes are now:
bytecode.cvd: 275 KiB
main.cvd: 85 MiB
daily.cvd: 22 MiB

Our team is continuing to monitor alerts and the current threat landscape and we are committed to reintroducing retired signatures as needed.

For more detailed information on the ClamAV signature please see our previous blog post.
ClamAV Signature Retirement Announcement

If you have any questions please join our ClamAV mailer here: ClamAV contact
Or our ClamAV Discord Server here: ClamAV Discord Server

ClamAV Signature Retirement Announcement

2025-11-18T13:51:00.007-05:00

ClamAV was first introduced in 2002; since then, the signature set has grown without bound, delivering as many detections as possible to the community. Due to continually increasing database sizes and user adoption, we are faced with significantly increasing costs of distributing the signature set to the community.

To address the issue, Cisco Talos has been working to evaluate the efficacy and relevance of older signatures. Signatures which no longer provide value to the community, based on today’s security landscape, will be retired.

We are making this announcement as an advisory that our first pass of this retirement effort will affect a significant drop in database size for both the daily.cvd and main.cvd.

Our goal is to ensure that detection content is targeted to currently active threats and campaigns. We will judge this based on signature matches seen in our, and our partners, data feeds over an extended period of time. We will continue to evaluate detection prevalence for retired signatures and will restore any signatures to the active signature set as needed to protect the community. Going forwards, we will continue to curate the signature set to match the security landscape. This may result in further reductions in the total number of signatures included in the signature set alongside the normal growth that comes from new added coverage.

These are the impacts on signature database sizes you can expect from the first pass:

File Name	September 2025	December 2025 after retirement of signatures
main.cvd	163 MB	~80 MB
daily.cvd	62 MB	~22 MB

In addition to the reduction in size of the signature set, we will also begin to remove container images from Docker Hub. We are doing this to remove container images which may contain vulnerabilities either in ClamAV or in the base image, and to reduce the burden on Docker Hub itself, which presently hosts over 300 GiB of ClamAV container images.

When complete, we will only provide container images on Docker Hub for the supported versions of ClamAV. At this time, these will include:

Release	Tags
1.5	1.5, 1.5.1, latest, stable
1.4 LTS	1.4, 1.4.3
1.0 LTS	1.0, 1.0.9

We recommend that ClamAV container image users select a feature release tag rather than a specific minor release tag in order to stay up to date with security and bug fixes.

ClamAV Signature Retirement Open Source FAQ:

What if bad actors begin to reuse old malware and old exploits?
Our team is committed to reintroducing any signature based on the activity of bad actors in a timely fashion.

Can open-source users access the signatures that have been retired from main.cvd?
We intend to make the retired signatures available at a later date for researchers and corner cases

Is this an ongoing process?
Cisco Talos will continue to curate the signature set and may retire signatures as they lose relevance to today’s security landscape.

How will open source Users benefit from these changes?
Smaller file downloads come with inherent advantages, but unbound growth is not sustainable and we already have outgrown resource needs for scanning on some server configurations. We anticipate a noticeable RAM usage reduction for the ClamAV engine, possibly by as much as 25%.

When will users see a change in file sizes?
Signature retirement and the file size reduction will begin on December 16^th , 2025.
Users will notice that the main.cvd and daily.cvd will be roughly 50% smaller than they have seen prior to that date.

ClamAV 1.5.1 patch version published

2025-10-16T11:17:00.000-04:00

Today, we are publishing ClamAV 1.5.1.

This version has been released shortly after ClamAV 1.5.0 in order to address several significant issues that were identified following its publication.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day.

ClamAV 1.5.1 is a patch release with the following fixes:

Fixed a significant performance issue when scanning some PE files
Fixed an issue recording file entries from a ZIP archive central directory which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the ClamScan --alert-exceeds-max command line option or ClamD AlertExceedsMax config file option
Improved performance when scanning TNEF email attachments
Fixed an issue with recording metadata for OOXML office documents
Fixed an issue with signature matches for VBA in OLE2 office documents
Loosened overly restrictive rules for embedded file identification and increased the limit for finding PE files embedded in other PE files
Fixed an issue with extracting some RAR archives embedded in other files
Fixed an issue with calculating fuzzy hashes affecting some images by updating the version for several Rust library dependencies
- This release does not require a newer version of the Rust compiler toolchain than what was required for ClamAV 1.5.0

GitHub pull request

ClamAV 1.5.0 released!

2025-10-07T09:35:00.002-04:00

The ClamAV 1.5.0 is now available. You may find the source code and installers for this release at clamav.net/downloads or on the ClamAV GitHub release page.

IMPORTANT: A major feature of the 1.5 release is a FIPS-mode compatible method for verifying the authenticity of CVD signature database archives and CDIFF signature database patch files. This feature relies on “.cvd.sign” signature files for the daily, main, and bytecode databases. The Freshclam with 1.5.0 will download these files as will the latest version of CVDUpdate. When they are not present, ClamAV will fall back to using the legacy MD5-based RSA signature check.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.5.0.tar.gz" does not require an internet connection to build. All dependencies are included in this package. However, if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

ClamAV 1.5.0 includes the following improvements and changes: 
Major changesAdded checks to determine if an OLE2-based Microsoft Office document is encrypted.
GitHub pull request
Added the ability to record URIs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record HTML URIs. The ClamScan command-line option is --json-store-html-uris=no. The clamd.conf config option is JsonStoreHTMLURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URIS
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
Added the ability to record URIs found in PDFs if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record PDF URIs. The ClamScan command-line option is --json-store-pdf-uris=no. The clamd.conf config option is JsonStorePDFURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URIS
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
GitHub pull request #4
Added regex support for the clamd.conf OnAccessExcludePath config option. This change courtesy of GitHub user b1tg.
GitHub pull request
Added CVD signing/verification with external .sign files.
Freshclam will now attempt to download external signature files to accompany existing .cvd databases and .cdiff patch files. Sigtool now has commands to sign and verify using the external signatures.
ClamAV now installs a 'certs' directory in the app config directory (e.g., <prefix>/etc/certs). The install path is configurable. The CMake option to configure the CVD certs directory is -D CVD_CERTS_DIRECTORY=PATH
New options to set an alternative CVD certs directory:
The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is --cvdcertsdir PATH
The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is CVD_CERTS_DIR
The config option for Freshclam and ClamD is CVDCertsDirectory PATH
Added two new APIs to the public clamav.h header:
cl_error_t cl_cvdverify_ex(
    const char *file,
    const char *certs_directory,
    uint32_t dboptions);

cl_error_t cl_cvdunpack_ex(
    const char *file,
    const char *dir,
    const char *certs_directory,
    uint32_t dboptions);
The original cl_cvdverify and cl_cvdunpack are deprecated.
Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.
Thank you to Mark Carey at SAP for inspiring work on this feature with an initial proof of concept for external-signature FIPS compliant CVD signing.
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
GitHub pull request #4
Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable FIPS-like limits disabling MD5 and SHA1 from being used for verifying digital signatures or for being used to trust a file when checking for false positives (FPs).
For freshclam.conf and clamd.conf set this config option:
FIPSCryptoHashLimits yes
For clamscan and sigtool use this command-line option:
--fips-limits
For libclamav: Enable FIPS-limits for a ClamAV engine like this:
cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);
ClamAV will also attempt to detect if FIPS-mode is enabled. If so, it will automatically enable the FIPS-limits feature.
This change mitigates safety concerns over the use of MD5 and SHA1 algorithms to trust files and is required to enable ClamAV to operate legitimately in FIPS-mode enabled environments.
Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for detection purposes or for informational purposes in FIPS-enabled environments and when the FIPS-limits option is enabled.
GitHub pull request
Upgraded the clean-file scan cache to use SHA2-256 (prior versions use MD5). The clean-file cache algorithm is not configurable.
This change resolves safety concerns over the use of MD5 to trust files and is required to enable ClamAV to operate legitimately in FIPS-mode enabled environments.
GitHub pull request #1
GitHub pull request #2
ClamD: Added an option to disable select administrative commands including SHUTDOWN, RELOAD, STATS and VERSION.
The new clamd.conf options are:
EnableShutdownCommand yes
EnableReloadCommand yes
EnableStatsCommand yes
EnableVersionCommand yes
This change courtesy of GitHub user ChaoticByte.
GitHub pull request
libclamav: Added extended hashing functions with a "flags" parameter that allows the caller to choose if they want to bypass FIPS hash algorithm limits:
cl_error_t cl_hash_data_ex(
    const char *alg,
    const uint8_t *data,
    size_t data_len,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);

cl_error_t cl_hash_init_ex(
    const char *alg,
    uint32_t flags,
    cl_hash_ctx_t **ctx_out);

cl_error_t cl_update_hash_ex(
    cl_hash_ctx_t *ctx,
    const uint8_t *data,
    size_t length);

cl_error_t cl_finish_hash_ex(
    cl_hash_ctx_t *ctx,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);

void cl_hash_destroy(void *ctx);

cl_error_t cl_hash_file_fd_ex(
    const char *alg,
    int fd,
    size_t offset,
    size_t length,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);
GitHub pull request
ClamScan: Improved the precision of the bytes-scanned and bytes-read counters. The ClamScan scan summary will now report exact counts in "GiB", "MiB", "KiB", or "B" as appropriate. Previously, it always reported "MB".
GitHub pull request
ClamScan: Add hash & file-type in/out CLI options:
--hash-hint: The file hash so that libclamav does not need to calculate it. The type of hash must match the --hash-alg.
--log-hash: Print the file hash after each file scanned. The type of hash printed will match the --hash-alg.
--hash-alg: The hashing algorithm used for either --hash-hint or --log-hash. Supported algorithms are "md5", "sha1", "sha2-256". If not specified, the default is "sha2-256".
--file-type-hint: The file type hint so that libclamav can optimize scanning (e.g., "pe", "elf", "zip", etc.). You may also use ClamAV type names such as "CL_TYPE_PE". ClamAV will ignore the hint if it is not familiar with the specified type. See also: https://docs.clamav.net/appendix/FileTypes.html#file-types
--log-file-type: Print the file type after each file scanned.
We will not be adding this for ClamDScan, as we do not have a mechanism in the ClamD socket API to receive scan options or a way for ClamD to include scan metadata in the response.
GitHub pull request
libclamav: Added new scan functions that provide additional functionality:
cl_error_t cl_scanfile_ex(
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);

cl_error_t cl_scandesc_ex(
    int desc,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);

cl_error_t cl_scanmap_ex(
    cl_fmap_t *map,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);
The older cl_scan*() functions are now deprecated and may be removed in a future release. See clamav.h for more details.
GitHub pull request
libclamav: Added a new engine option to toggle temp directory recursion.
Temp directory recursion is the idea that each object scanned in ClamAV's recursive extract/scan process will get a new temp subdirectory, mimicking the nesting structure of the file.
Temp directory recursion was introduced in ClamAV 0.103 and is enabled whenever --leave-temps / LeaveTemporaryFiles is enabled.
In ClamAV 1.5, an application linking to libclamav can separately enable temp directory recursion if they wish. For ClamScan and ClamD, it will remain tied to --leave-temps / LeaveTemporaryFiles options.
The new temp directory recursion option can be enabled with:
cl_engine_set_num(engine, CL_ENGINE_TMPDIR_RECURSION, 1);
GitHub pull request
libclamav: Added a class of scan callback functions that can be added with the following API function:
void cl_engine_set_scan_callback(struct cl_engine *engine, clcb_scan callback, cl_scan_callback_t location);
The scan callback location may be configured using the following five values:
CL_SCAN_CALLBACK_PRE_HASH: Occurs just after basic file-type detection and before any hashes have been calculated either for the cache or the gen-json metadata.
CL_SCAN_CALLBACK_PRE_SCAN: Occurs before parser modules run and before pattern matching.
CL_SCAN_CALLBACK_POST_SCAN: Occurs after pattern matching and after running parser modules. A.k.a. the scan is complete for this layer.
CL_SCAN_CALLBACK_ALERT: Occurs each time an alert (detection) would be triggered during a scan.
CL_SCAN_CALLBACK_FILE_TYPE: Occurs each time the file type determination is refined. This may happen more than once per layer.
Each callback may alter scan behavior using the following return codes:
CL_BREAK: Scan aborted by callback. The rest of the scan is skipped. This does not mark the file as clean or infected, it just skips the rest of the scan.
CL_SUCCESS / CL_CLEAN: File scan will continue.
For CL_SCAN_CALLBACK_ALERT: This means you want to ignore this specific alert and keep scanning.
This is different than CL_VERIFIED because it does not affect prior or future alerts. Return CL_VERIFIED instead if you want to remove prior alerts for this layer and skip the rest of the scan for this layer.
CL_VIRUS: This means you do not trust the file. A new alert will be added.
For CL_SCAN_CALLBACK_ALERT: This means you agree with the alert and no extra alert is needed.
CL_VERIFIED: Layer explicitly trusted by the callback and previous alerts removed for THIS layer. You might want to do this if you trust the hash or verified a digital signature. The rest of the scan will be skipped for THIS layer. For contained files, this does NOT mean that the parent or adjacent layers are trusted.
Each callback is given a pointer to the current scan layer from which they can get previous layers, can get the layer's fmap, and then various attributes of the layer and of the fmap. To make this possible, there are new APIs to query scan-layer details and fmap details:
  cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name);
  cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out);
  cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path);
  cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, size_t *offset_out, size_t *len_out);
  cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t *offset_out, size_t *len_out);
  cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t *size_out);
  cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char *hash_alg, char hash);
  cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char *hash_alg, bool *have_hash_out);
  cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const char *hash_alg);
  cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char *hash_alg, char **hash_out);
  cl_error_t cl_fmap_get_data(const cl_fmap_t *map, size_t offset, size_t len, const uint8_t **data_out, size_t *data_len_out);
  cl_error_t cl_scan_layer_get_fmap(cl_scan_layer_t *layer, cl_fmap_t **fmap_out);
  cl_error_t cl_scan_layer_get_parent_layer(cl_scan_layer_t *layer, cl_scan_layer_t **parent_layer_out);
  cl_error_t cl_scan_layer_get_type(cl_scan_layer_t *layer, const char **type_out);
  cl_error_t cl_scan_layer_get_recursion_level(cl_scan_layer_t *layer, uint32_t *recursion_level_out);
  cl_error_t cl_scan_layer_get_object_id(cl_scan_layer_t *layer, uint64_t *object_id_out);
  cl_error_t cl_scan_layer_get_last_alert(cl_scan_layer_t *layer, const char **alert_name_out);
  cl_error_t cl_scan_layer_get_attributes(cl_scan_layer_t *layer, uint32_t *attributes_out);
This deprecates, but does not immediately remove, the existing scan callbacks:
  void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cache callback);
  void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, clcb_file_inspection callback);
  void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan callback);
  void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);
  void cl_engine_set_clcb_virus_found(struct cl_engine *engine, clcb_virus_found callback);
  void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback);
There is an interactive test program to demonstrate the new callbacks. See: examples/ex_scan_callbacks.c
GitHub pull request
Signature names that start with "Weak." will no longer alert. Instead, they will be tracked internally and can be found in scan metadata JSON. This is a step towards enabling alerting signatures to depend on prior Weak indicator matches in the current layer or in child layers.
GitHub pull request
For the "Generate Metadata JSON" feature:
The "Viruses" array of alert names has been replaced by two new arrays that include additional details beyond just signature name:
"Indicators" records three types of indicators:Strong indicators are for traditional alerting signature matches and will halt the scan, except in all-match mode.
Potentially Unwanted indicators will only cause an alert at the end of the scan unless a Strong indicator is found. They are treated the same as Strong indicators in all-match mode.
Weak indicators do not alert and will be leveraged in a future version as a condition for logical signature matches.
"Alerts" records only alerting indicators. Events that trust a file, such as false positive signatures, will remove affected indicators, and mark them as "Ignored" in the "Indicators" array.
Add new option to calculate and record additional hash types when the "generate metadata JSON" feature is enabled:
libclamav option: CL_SCAN_GENERAL_STORE_EXTRA_HASHES
ClamScan option: --json-store-extra-hashes (default off)
clamd.conf option: JsonStoreExtraHashes (default 'no')
The file hash is now stored as "sha2-256" instead of "FileMD5". If you enable the "extra hashes" option, then it will also record "md5" and "sha1".
Each object scanned now has a unique "Object ID".
GitHub pull request
Sigtool: Renamed the sigtool option --sha256 to --sha2-256. The original option is still functional but is deprecated.
GitHub pull request
Other improvementsSet a limit on the max-recursion config option. Users will no longer be able to set max-recursion higher than 100. This change prevents errors on start up or crashes if encountering a file with that many layers of recursion.
GitHub pull request
Build system: CMake improvements to support compiling for the AIX platform. This change is courtesy of GitHub user KamathForAIX.
GitHub pull request
Improve support for extracting malformed zip archives. This change is courtesy of Frederick Sell.
GitHub pull request
Windows: Code quality improvement for the ClamScan and ClamDScan --move and --remove options. This change is courtesy of Maxim Suhanov.
GitHub pull request
Added file type recognition for an initial set of AI model file types.
The file type is accessible to applications using libclamav via the scan callback functions and as an optional output parameter to the scan functions: cl_scanfile_ex(), cl_scanmap_ex(), and cl_scandesc_ex().
When scanning these files, type will now show "CL_TYPE_AI_MODEL" instead of "CL_TYPE_BINARY_DATA".
GitHub pull request
Added support for inline comments in ClamAV configuration files. This change is courtesy of GitHub user userwiths.
GitHub pull request
Disabled the MyDoom hardcoded/heuristic detection because of false positives.
GitHub pull request
Sigtool: Added support for creating .cdiff and .script patch files for CVDs that have underscores in the CVD name. Also improved support for relative paths with the --diff command.
GitHub pull request
Windows: Improved support for file names with UTF-8 characters not found in the ANSI or OEM code pages when printing scan results or showing activity in the ClamDTOP monitoring utility. Fixed a bug with opening files with such names with the Sigtool utility.
GitHub pull request #1
GitHub pull request #2
Improved the code quality of the ZIP module. Added inline documentation.
GitHub pull request #1
GitHub pull request #2
Always run scan callbacks for embedded files. Embedded files are found within other files through signature matches instead of by parsing. They will now be processed the same way and then they can trigger application callbacks (e.g., "pre-scan", "post-scan", etc.).
A consequence of this change is that each embedded file will be pattern- matched just like any other extracted file. To minimize excessive pattern matching, file header validation checks were added for ZIP, ARJ, and CAB. Also fixed a bug with embedded PE file scanning to reduce unnecessary matching.
This change will impact scans with both the "leave-temps" feature and the "force-to-disk" feature enabled, resulting in additional temporary files.
GitHub pull request #1
GitHub pull request #2
Added DevContainer templates to the ClamAV Git repository in order to make it easier to set up AlmaLinux or Debian development environments.
GitHub pull request
Removed the "Heuristics.XZ.DicSizeLimit" alert because of potential unintended alerts based on system state.
GitHub pull request
Improved support for compiling on Solaris.
This fix courtesy of Andrew Watkins.
GitHub pull request
Improved support for compiling on GNU/Hurd.
This fix courtesy of Pino Toscano.
GitHub pull request
Improved support for linking with the NCurses library dependency when libtinfo is built as a separate library.
GitHub pull request
Bug fixesReduced email multipart message parser complexity.
GitHub pull request
Fixed possible undefined behavior in inflate64 module. The inflate64 module is a modified version of the zlib library, taken from version 1.2.3 with some customization and with some cherry-picked fixes. This adds one additional fix from zlib 1.2.9. Thank you to TITAN Team for reporting this issue.
GitHub pull request
Fixed a bug in ClamD that broke reporting of memory usage on Linux. The STATS command can be used to monitor ClamD directly or through ClamDTOP. The memory stats feature does not work on all platforms (e.g., Windows).
GitHub pull request
Windows: Fixed a build issue when the same library dependency is found in two different locations.
GitHub pull request
Fixed an infinite loop when scanning some email files in debug-mode. This fix is courtesy of Yoann Lecuyer.
GitHub pull request
Fixed a stack buffer overflow bug in the phishing signature load process. This fix is courtesy of GitHub user Shivam7-1.
GitHub pull request
Fixed a race condition in the Freshclam feature tests. This fix is courtesy of GitHub user rma-x.
GitHub pull request
Windows: Fixed a 5-byte heap buffer overread in the Windows unit tests. This fix is courtesy of GitHub user Sophie0x2E.
GitHub pull request
Fix double-extraction of OOXML-based office documents.
GitHub pull request
ClamBC: Fixed crashes on startup.
GitHub pull request
Fixed an assortment of issues found with Coverity static analysis.
GitHub pull request #1
GitHub pull request #2
Fixed libclamav unit test, ClamD, and ClamDScan Valgrind test failures affecting some platforms.
GitHub pull request #1
GitHub pull request #2
Fixed crash in the Sigtool program when using the --html-normalize option.
GitHub pull request
Fixed some potential NULL-pointer dereference issues if memory allocations fail.
Fix courtesy of GitHub user JiangJias.
GitHub pull request
AcknowledgmentsSpecial thanks to the following people for code contributions and bug reports:
Andrew Watkins
b1tg
ChaoticByte
Frederick Sell
KamathForAIX
Mark Carey at SAP
Maxim Suhanov
Pino Toscano
rma-x
Shivam7-1
Sophie0x2E
TITAN Team
userwiths
Yoann Lecuyer

ClamAV 1.5.0 release candidate now available!

2025-08-20T11:27:00.000-04:00

The ClamAV 1.5.0 release candidate is now available. You may find the source code and installers for this release at clamav.net/downloads or on the ClamAV GitHub release page.

The release candidate phase is expected to last two to four weeks before we publish the stable release. This will depend on whether any changes are required to stabilize this version. Please take this time to evaluate ClamAV 1.5.0.

Please help us validate this release by providing feedback via GitHub issues, via the ClamAV mailing list or on our Discord.

IMPORTANT: A major feature of the 1.5 release is a FIPS-compliant method for verifying the authenticity of CVD signature database archives and CDIFF signature database patch files. The feature is ready to test in this release candidate, but we are not yet distributing the associated “.cvd.sign” signature files for the daily, main, and bytecode databases. Because these files are not available, ClamAV will fall back to using the legacy MD5-based RSA signature check. In other words, Freshclam will continue to fail on FIPS-enabled systems for now. However, the unit tests do include a test signing key and certificate pair along with tests to exercise signing and verification using the FIPS-compliant method.

Note: Windows builds on GitHub Actions, which use VCPkg to provide C library dependencies, are failing at this time.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.5.0-release candidate.tar.gz" does not require an internet connection to build. All dependencies are included in this package. However, if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the release candidate, but you can use the clamav:unstable or clamav:unstable_base tags.

ClamAV 1.5.0 includes the following improvements and changes: 
Major changesAdded checks to determine if an OLE2-based Microsoft Office document is encrypted.
GitHub pull request
Added the ability to record URIs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record HTML URIs. The ClamScan command-line option is --json-store-html-uris=no. The clamd.conf config option is JsonStoreHTMLURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URIS
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
Added the ability to record URIs found in PDFs if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but do not want to record PDF URIs. The ClamScan command-line option is --json-store-pdf-uris=no. The clamd.conf config option is JsonStorePDFURIs no. The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URIS
GitHub pull request #1
GitHub pull request #2
Added regex support for the clamd.conf OnAccessExcludePath config option. This change courtesy of GitHub user b1tg.
GitHub pull request
Added CVD signing/verification with external .sign files.
Freshclam will now attempt to download external signature files to accompany existing .cvd databases and .cdiff patch files. Sigtool now has commands to sign and verify using the external signatures.
ClamAV now installs a 'certs' directory in the app config directory (e.g., <prefix>/etc/certs). The install path is configurable. The CMake option to configure the CVD certs directory is -D CVD_CERTS_DIRECTORY=PATH
New options to set an alternative CVD certs directory:
The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is --cvdcertsdir PATH
The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is CVD_CERTS_DIR
The config option for Freshclam and ClamD is CVDCertsDirectory PATH
Added two new APIs to the public clamav.h header:
cl_error_t cl_cvdverify_ex(
    const char *file,
    const char *certs_directory,
    uint32_t dboptions);

cl_error_t cl_cvdunpack_ex(
    const char *file,
    const char *dir,
    const char *certs_directory,
    uint32_t dboptions);
The original cl_cvdverify and cl_cvdunpack are deprecated.
Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may set this option with cl_engine_set_str and get it with cl_engine_get_str, to override the compiled in default CVD certs directory.
Thank you to Mark Carey at SAP for inspiring work on this feature with an initial proof of concept for external-signature FIPS compliant CVD signing.
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
GitHub pull request #4
Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable FIPS-like limits disabling MD5 and SHA1 from being used for verifying digital signatures or for being used to trust a file when checking for false positives (FPs).
For freshclam.conf and clamd.conf set this config option:
FIPSCryptoHashLimits yes
For clamscan and sigtool use this command-line option:
--fips-limits
For libclamav: Enable FIPS-limits for a ClamAV engine like this:
cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);
ClamAV will also attempt to detect if FIPS-mode is enabled. If so, it will automatically enable the FIPS-limits feature.
This change mitigates safety concerns over the use of MD5 and SHA1 algorithms to trust files and is required to enable ClamAV to operate legitimately in FIPS-mode enabled environments.
Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for detection purposes or for informational purposes in FIPS-enabled environments and when the FIPS-limits option is enabled.
GitHub pull request
Upgraded the clean-file scan cache to use SHA2-256 (prior versions use MD5). The clean-file cache algorithm is not configurable.
This change resolves safety concerns over the use of MD5 to trust files and is required to enable ClamAV to operate legitimately in FIPS-mode enabled environments.
GitHub pull request
ClamD: Added an option to disable select administrative commands including SHUTDOWN, RELOAD, STATS and VERSION.
The new clamd.conf options are:
EnableShutdownCommand yes
EnableReloadCommand yes
EnableStatsCommand yes
EnableVersionCommand yes
This change courtesy of GitHub user ChaoticByte.
GitHub pull request
libclamav: Added extended hashing functions with a "flags" parameter that allows the caller to choose if they want to bypass FIPS hash algorithm limits:
cl_error_t cl_hash_data_ex(
    const char *alg,
    const uint8_t *data,
    size_t data_len,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);

cl_error_t cl_hash_init_ex(
    const char *alg,
    uint32_t flags,
    cl_hash_ctx_t **ctx_out);

cl_error_t cl_update_hash_ex(
    cl_hash_ctx_t *ctx,
    const uint8_t *data,
    size_t length);

cl_error_t cl_finish_hash_ex(
    cl_hash_ctx_t *ctx,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);

void cl_hash_destroy(void *ctx);

cl_error_t cl_hash_file_fd_ex(
    const char *alg,
    int fd,
    size_t offset,
    size_t length,
    uint8_t **hash,
    size_t *hash_len,
    uint32_t flags);
GitHub pull request
ClamScan: Improved the precision of the bytes-scanned and bytes-read counters. The ClamScan scan summary will now report exact counts in "GiB", "MiB", "KiB", or "B" as appropriate. Previously, it always reported "MB".
GitHub pull request
ClamScan: Add hash & file-type in/out CLI options:
--hash-hint: The file hash so that libclamav does not need to calculate it. The type of hash must match the --hash-alg.
--log-hash: Print the file hash after each file scanned. The type of hash printed will match the --hash-alg.
--hash-alg: The hashing algorithm used for either --hash-hint or --log-hash. Supported algorithms are "md5", "sha1", "sha2-256". If not specified, the default is "sha2-256".
--file-type-hint: The file type hint so that libclamav can optimize scanning (e.g., "pe", "elf", "zip", etc.). You may also use ClamAV type names such as "CL_TYPE_PE". ClamAV will ignore the hint if it is not familiar with the specified type. See also: https://docs.clamav.net/appendix/FileTypes.html#file-types
--log-file-type: Print the file type after each file scanned.
We will not be adding this for ClamDScan, as we do not have a mechanism in the ClamD socket API to receive scan options or a way for ClamD to include scan metadata in the response.
GitHub pull request
libclamav: Added new scan functions that provide additional functionality:
cl_error_t cl_scanfile_ex(
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);

cl_error_t cl_scandesc_ex(
    int desc,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);

cl_error_t cl_scanmap_ex(
    cl_fmap_t *map,
    const char *filename,
    cl_verdict_t *verdict_out,
    const char **last_alert_out,
    uint64_t *scanned_out,
    const struct cl_engine *engine,
    struct cl_scan_options *scanoptions,
    void *context,
    const char *hash_hint,
    char **hash_out,
    const char *hash_alg,
    const char *file_type_hint,
    char **file_type_out);
The older cl_scan*() functions are now deprecated and may be removed in a future release. See clamav.h for more details.
GitHub pull request
libclamav: Added a new engine option to toggle temp directory recursion.
Temp directory recursion is the idea that each object scanned in ClamAV's recursive extract/scan process will get a new temp subdirectory, mimicking the nesting structure of the file.
Temp directory recursion was introduced in ClamAV 0.103 and is enabled whenever --leave-temps / LeaveTemporaryFiles is enabled.
In ClamAV 1.5, an application linking to libclamav can separately enable temp directory recursion if they wish. For ClamScan and ClamD, it will remain tied to --leave-temps / LeaveTemporaryFiles options.
The new temp directory recursion option can be enabled with:
cl_engine_set_num(engine, CL_ENGINE_TMPDIR_RECURSION, 1);
GitHub pull request
libclamav: Added a class of scan callback functions that can be added with the following API function:
void cl_engine_set_scan_callback(struct cl_engine *engine, clcb_scan callback, cl_scan_callback_t location);
The scan callback location may be configured using the following five values:
CL_SCAN_CALLBACK_PRE_HASH: Occurs just after basic file-type detection and before any hashes have been calculated either for the cache or the gen-json metadata.
CL_SCAN_CALLBACK_PRE_SCAN: Occurs before parser modules run and before pattern matching.
CL_SCAN_CALLBACK_POST_SCAN: Occurs after pattern matching and after running parser modules. A.k.a. the scan is complete for this layer.
CL_SCAN_CALLBACK_ALERT: Occurs each time an alert (detection) would be triggered during a scan.
CL_SCAN_CALLBACK_FILE_TYPE: Occurs each time the file type determination is refined. This may happen more than once per layer.
Each callback may alter scan behavior using the following return codes:
CL_BREAK: Scan aborted by callback. The rest of the scan is skipped. This does not mark the file as clean or infected, it just skips the rest of the scan.
CL_SUCCESS / CL_CLEAN: File scan will continue.
For CL_SCAN_CALLBACK_ALERT: This means you want to ignore this specific alert and keep scanning.
This is different than CL_VERIFIED because it does not affect prior or future alerts. Return CL_VERIFIED instead if you want to remove prior alerts for this layer and skip the rest of the scan for this layer.
CL_VIRUS: This means you do not trust the file. A new alert will be added.
For CL_SCAN_CALLBACK_ALERT: This means you agree with the alert and no extra alert is needed.
CL_VERIFIED: Layer explicitly trusted by the callback and previous alerts removed for THIS layer. You might want to do this if you trust the hash or verified a digital signature. The rest of the scan will be skipped for THIS layer. For contained files, this does NOT mean that the parent or adjacent layers are trusted.
Each callback is given a pointer to the current scan layer from which they can get previous layers, can get the layer's fmap, and then various attributes of the layer and of the fmap. To make this possible, there are new APIs to query scan-layer details and fmap details:
  cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name);
  cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out);
  cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path);
  cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, size_t *offset_out, size_t *len_out);
  cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t *offset_out, size_t *len_out);
  cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t *size_out);
  cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char *hash_alg, char hash);
  cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char *hash_alg, bool *have_hash_out);
  cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const char *hash_alg);
  cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char *hash_alg, char **hash_out);
  cl_error_t cl_fmap_get_data(const cl_fmap_t *map, size_t offset, size_t len, const uint8_t **data_out, size_t *data_len_out);
  cl_error_t cl_scan_layer_get_fmap(cl_scan_layer_t *layer, cl_fmap_t **fmap_out);
  cl_error_t cl_scan_layer_get_parent_layer(cl_scan_layer_t *layer, cl_scan_layer_t **parent_layer_out);
  cl_error_t cl_scan_layer_get_type(cl_scan_layer_t *layer, const char **type_out);
  cl_error_t cl_scan_layer_get_recursion_level(cl_scan_layer_t *layer, uint32_t *recursion_level_out);
  cl_error_t cl_scan_layer_get_object_id(cl_scan_layer_t *layer, uint64_t *object_id_out);
  cl_error_t cl_scan_layer_get_last_alert(cl_scan_layer_t *layer, const char **alert_name_out);
  cl_error_t cl_scan_layer_get_attributes(cl_scan_layer_t *layer, uint32_t *attributes_out);
This deprecates, but does not immediately remove, the existing scan callbacks:
  void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, clcb_pre_cache callback);
  void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, clcb_file_inspection callback);
  void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, clcb_pre_scan callback);
  void cl_engine_set_clcb_post_scan(struct cl_engine *engine, clcb_post_scan callback);
  void cl_engine_set_clcb_virus_found(struct cl_engine *engine, clcb_virus_found callback);
  void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash callback);
There is an interactive test program to demonstrate the new callbacks. See: examples/ex_scan_callbacks.c
GitHub pull request
Signature names that start with "Weak." will no longer alert. Instead, they will be tracked internally and can be found in scan metadata JSON. This is a step towards enabling alerting signatures to depend on prior Weak indicator matches in the current layer or in child layers.
GitHub pull request
For the "Generate Metadata JSON" feature:
The "Viruses" array of alert names has been replaced by two new arrays that include additional details beyond just signature name:
"Indicators" records three types of indicators:Strong indicators are for traditional alerting signature matches and will halt the scan, except in all-match mode.
Potentially Unwanted indicators will only cause an alert at the end of the scan unless a Strong indicator is found. They are treated the same as Strong indicators in all-match mode.
Weak indicators do not alert and will be leveraged in a future version as a condition for logical signature matches.
"Alerts" records only alerting indicators. Events that trust a file, such as false positive signatures, will remove affected indicators, and mark them as "Ignored" in the "Indicators" array.
Add new option to calculate and record additional hash types when the "generate metadata JSON" feature is enabled:
libclamav option: CL_SCAN_GENERAL_STORE_EXTRA_HASHES
ClamScan option: --json-store-extra-hashes (default off)
clamd.conf option: JsonStoreExtraHashes (default 'no')
The file hash is now stored as "sha2-256" instead of "FileMD5". If you enable the "extra hashes" option, then it will also record "md5" and "sha1".
Each object scanned now has a unique "Object ID".
GitHub pull request
Sigtool: Renamed the sigtool option --sha256 to --sha2-256. The original option is still functional but is deprecated.
GitHub pull request
Other improvementsSet a limit on the max-recursion config option. Users will no longer be able to set max-recursion higher than 100. This change prevents errors on start up or crashes if encountering a file with that many layers of recursion.
GitHub pull request
Build system: CMake improvements to support compiling for the AIX platform. This change is courtesy of GitHub user KamathForAIX.
GitHub pull request
Improve support for extracting malformed zip archives. This change is courtesy of Frederick Sell.
GitHub pull request
Windows: Code quality improvement for the ClamScan and ClamDScan --move and --remove options. This change is courtesy of Maxim Suhanov.
GitHub pull request
Added file type recognition for an initial set of AI model file types.
The file type is accessible to applications using libclamav via the scan callback functions and as an optional output parameter to the scan functions: cl_scanfile_ex(), cl_scanmap_ex(), and cl_scandesc_ex().
When scanning these files, type will now show "CL_TYPE_AI_MODEL" instead of "CL_TYPE_BINARY_DATA".
GitHub pull request
Added support for inline comments in ClamAV configuration files. This change is courtesy of GitHub user userwiths.
GitHub pull request
Disabled the MyDoom hardcoded/heuristic detection because of false positives.
GitHub pull request
Sigtool: Added support for creating .cdiff and .script patch files for CVDs that have underscores in the CVD name. Also improved support for relative paths with the --diff command.
GitHub pull request
Windows: Improved support for file names with UTF-8 characters not found in the ANSI or OEM code pages when printing scan results or showing activity in the ClamDTOP monitoring utility. Fixed a bug with opening files with such names with the Sigtool utility.
GitHub pull request #1
GitHub pull request #2
Improved the code quality of the ZIP module. Added inline documentation.
GitHub pull request #1
GitHub pull request #2
Always run scan callbacks for embedded files. Embedded files are found within other files through signature matches instead of by parsing. They will now be processed the same way and then they can trigger application callbacks (e.g., "pre-scan", "post-scan", etc.).
This change will impact scans with both the "leave-temps" feature and the "force-to-disk" feature enabled, resulting in additional temporary files.
GitHub pull request
Added DevContainer templates to the ClamAV Git repository in order to make it easier to set up AlmaLinux or Debian development environments.
GitHub pull request
Bug fixesReduced email multipart message parser complexity.
GitHub pull request
Fixed possible undefined behavior in inflate64 module. The inflate64 module is a modified version of the zlib library, taken from version 1.2.3 with some customization and with some cherry-picked fixes. This adds one additional fix from zlib 1.2.9. Thank you to TITAN Team for reporting this issue.
GitHub pull request
Fixed a bug in ClamD that broke reporting of memory usage on Linux. The STATS command can be used to monitor ClamD directly or through ClamDTOP. The memory stats feature does not work on all platforms (e.g., Windows).
GitHub pull request
Windows: Fixed a build issue when the same library dependency is found in two different locations.
GitHub pull request
Fixed an infinite loop when scanning some email files in debug-mode. This fix is courtesy of Yoann Lecuyer.
GitHub pull request
Fixed a stack buffer overflow bug in the phishing signature load process. This fix is courtesy of GitHub user Shivam7-1.
GitHub pull request
Fixed a race condition in the Freshclam feature tests. This fix is courtesy of GitHub user rma-x.
GitHub pull request
Windows: Fixed a 5-byte heap buffer overread in the Windows unit tests. This fix is courtesy of GitHub user Sophie0x2E.
GitHub pull request
Fix double-extraction of OOXML-based office documents.
GitHub pull request
ClamBC: Fixed crashes on startup.
GitHub pull request
AcknowledgmentsSpecial thanks to the following people for code contributions and bug reports:
b1tg
ChaoticByte
Frederick Sell
KamathForAIX
Mark Carey at SAP
Maxim Suhanov
rma-x
Shivam7-1
Sophie0x2E
TITAN Team
userwiths
Yoann Lecuyer

ClamAV 1.4.3 and 1.0.9 security patch versions published

2025-06-18T10:41:00.000-04:00

Today, we are publishing the 1.4.3 and 1.0.9 security patch versions.

We have also added Linux aarch64 (aka ARM64) RPM and DEB installer packages for the 1.4 LTS release.

1.4.3

ClamAV 1.4.3 is a patch release with the following fixes:

CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.
This issue only affects configurations where both:
1. The max file-size scan limit is set greater than or equal to 1024MB.
2. The max scan-size scan limit is set greater than or equal to 1025MB.
The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.3
- 1.0.9
Thank you to Greg Walkup at Sandia National Labs for identifying this issue.
CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition.
This issue was introduced in version 1.2.0. It will be fixed in 1.4.3.
Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero Day Initiative, for identifying this issue.
Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.
This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.
This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:
- 1.4.3
- 1.0.9
Thank you to OSS-Fuzz for identifying this issue.
Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.

1.0.9

ClamAV 1.0.9 is a patch release with the following fixes:

CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.
This issue only affects configurations where both:
1. The max file-size scan limit is set greater than or equal to 1024MB.
2. The max scan-size scan limit is set greater than or equal to 1025MB.
The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.3
- 1.0.9
Thank you to Greg Walkup at Sandia National Labs for identifying this issue.
Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library.
This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.
This issue affects all ClamAV versions at least as far back as 0.99.4. It will be fixed in:
- 1.4.3
- 1.0.9
Thank you to OSS-Fuzz for identifying this issue.
Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system.

ClamAV 1.5.0 beta now available!

2025-03-31T14:12:00.000-04:00

The ClamAV 1.5.0 beta is now available. You may find the source code and installers for this release at clamav.net/downloads or on the ClamAV GitHub release page.

The beta phase is expected to last two to four weeks before we publish the stable release or else publish a release candidate. This will depend on how many changes are required to stabilize this version. Please take this time to evaluate ClamAV 1.5.0.

Please help us validate this release by providing feedback via GitHub issues, via the ClamAV mailing list or on our Discord.

IMPORTANT: A major feature of the 1.5 release is a FIPS-compliant method for verifying the authenticity of CVD signature database archives and CDIFF signature database patch files. The feature is ready to test in this beta, but we are not yet distributing the associated “.cvd.sign” signature files for the daily, main, and bytecode databases. Because these files aren’t available, ClamAV will fall back to using the legacy MD5-based RSA signature check. In other words, Freshclam will continue to fail on FIPS-enabled systems, for now. However, the unit tests do include a test signing key and certificate pair along with tests to exercise signing and verification using the FIPS-compliant method.

Note: Windows builds on GitHub Actions, which use VCPkg to provide C library dependencies, are failing at this time.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.5.0-beta.tar.gz" does not require an internet connection to build. All dependencies are included in this package. However, if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the beta, but you can use the clamav:unstable or clamav:unstable_base tags.

ClamAV 1.5.0 includes the following improvements and changes:

Major changes

Added checks to determine if an OLE2-based Microsoft Office document is encrypted.

GitHub pull request

Added the ability to record URLs found in HTML if the generate-JSON-metadata feature is enabled. Also adds an option to disable this in case you want the JSON metadata feature but don't want to record HTML URL's. The ClamScan command-line option is “--json-store-html-urls=no”. The clamd.conf config option is “JsonStoreHTMLUrls no”.

GitHub pull request

Added regex support for the clamd.conf OnAccessExcludePath config option. This change courtesy of GitHub user b1tg.

GitHub pull request

Added FIPS-compliant CVD signing/verification with external .sign files.
Freshclam will now attempt to download external signature files to accompany existing .cvd databases and .cdiff patch files. Sigtool now has commands to sign and verify using the external signatures.

ClamAV now installs a 'certs' directory in the app config directory (e.g. <prefix>/etc/certs). The install path is configurable. The CMake option to configure the CVD certs directory is “-D CVD_CERTS_DIRECTORY=PATH”.

Added sign/verify commands to Sigtool.

New options to set an alternative CVD certs directory:
- The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is: --cvdcertsdir PATH
- The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is: CVD_CERTS_DIR

The config option for Freshclam and ClamD is: CVDCertsDirectory PATH

Added two new APIs to the public clamav.h header:
extern cl_error_t cl_cvdverify_ex(const char *file,
const char *certs_directory);
extern cl_error_t cl_cvdunpack_ex(const char *file,
const char *dir,
bool dont_verify,
const char *certs_directory);

The original cl_cvdverify and cl_cvdunpack are deprecated.

Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may set this option with cl_engine_set_str and get it with cl_engine_get_str to override the compiled in default CVD certs directory.

Thank you to Mark Carey at SAP for inspiring work on this feature with an initial proof of concept for external-signature FIPS compliant CVD signing.

GitHub pull request

Other improvements

Set a limit on the max-recursion config option. Users will no longer be able to set max-recursion higher than 100. This change prevents errors on start up or possible crashes if encountering a file with that many layers of recursion.

GitHub pull request

Build system: CMake improvements to support compiling for the AIX platform. This change is courtesy of GitHub user KamathForAIX.

GitHub pull request

Improve support for extracting malformed .zip archives. This change is courtesy of Frederick Sell.

GitHub pull request

Windows: Code quality improvement for the ClamScan and ClamDScan --move and --remove options. This change is the courtesy of Maxim Suhanov.

GitHub pull request

Added file type recognition for some kinds of AI model files.

The file type appears as a string parameter for these callback functions:
- clcb_pre_cache
- clcb_pre_scan
- clcb_file_inspection

When scanning these files, the `type` parameter will now show "CL_TYPE_AI_MODEL" instead of "CL_TYPE_BINARY_DATA".

GitHub pull request

Bug fixes

Technical debt: Reduced email multipart message parser complexity.

GitHub pull request

Fixed possible undefined behavior in inflate64 module. The inflate64 module is a modified version of the zlib library, taken from version 1.2.3 with some customization and with some cherry-picked fixes. This adds one additional fix from zlib 1.2.9. Thank you to TITAN Team for reporting this issue.

GitHub pull request

Fixed a bug in ClamD that broke reporting of memory usage on Linux. The STATS command can be used to monitor ClamD directly or through ClamDTOP. The memory stats feature does not work on all platforms (e.g. Windows).

GitHub pull request

Windows: Fix a build issue when the same library dependency is found in two different locations.

GitHub pull request

Fix an infinite loop when scanning some email files in debug-mode. This fix is courtesy of Yoann Lecuyer

GitHub pull request

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

b1tg
Frederick Sell
KamathForAIX
Mark Carey at SAP
Maxim Suhanov
TITAN Team
Yoann Lecuyer

Advance notice: End of Life for ClamAV 0.103 database updates

2025-03-27T06:00:00.001-04:00

ClamAV version 0.103 will reach its end of life (EOL) for database updates on September 14, 2025. After this date, this version will no longer receive the latest virus definitions.

To ensure your systems remain protected, please upgrade to the latest supported version of ClamAV before the end-of-life date. This will provide continued access to essential security updates and features.

We recommend that users update to the newest release, ClamAV 1.4 LTS. For users that are unable to upgrade to version 1.4, you may find that ClamAV 1.0 LTS is more suitable. The most recent version of ClamAV can be found on the ClamAV Downloads page, on the ClamAV GitHub Releases page, and through Docker Hub. Information about how to install ClamAV is available in our online documentation.

The following is a list of major changes available to users in the newest versions of ClamAV.

ClamAV 1.0 LTS improves upon ClamAV 0.103 with features such as:

A new detection capability based on comparing image fuzzy hashes
[Windows] A feature to start ClamD and Freshclam as Windows services
[Windows] A feature to scan process memory with either ClamScan or ClamDScan
Signature database load progress bars for ClamScan
Support for extracting images from OLE2-based Excel documents
The ability to use *.cat files with CRB signature rules to trust signed Windows executables
Support for decrypting read-only OLE2-based XLS files that are encrypted with the default password
Significant reliability improvements to the All-Match scanning mode Multiple libclamav API improvements

ClamAV 1.4 LTS improves upon ClamAV 1.0 with features such as:

Support for extracting Universal Disk Format (UDF) partitions
Support for extracting ALZ archives
Support for extracting LHA/LZH archives
Support for extracting images embedded in HTML CSS style-blocks
Support for extracting attachments found in Microsoft OneNote files
An option to customize the size of ClamAV's clean file cache
Effective removal of the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4GB. Note: This does not allow individual file size to exceed the 2GB limit
The ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror
A new ClamScan and ClamD option to fail to load if the provided signature database is older than a given number of days
Multiple libclamav API improvements

You can learn more about ClamAV's End of Life policy here. If you have any questions, please ask on our mailing list or in the ClamAV Discord.

Thank you for your continued support.

ClamAV 1.4.2 and 1.0.8 security patch versions published

2025-01-22T12:07:00.002-05:00

Today, we are publishing the 1.4.2 and 1.0.8 security patch versions. The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.

1.4.2

ClamAV 1.4.2 is a patch release with the following fixes:

CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 and 1.0.8

Thank you to OSS-Fuzz for identifying this issue.

1.0.8

ClamAV 1.0.8 is a patch release with the following fixes:

CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

This issue was introduced in version 1.0.0 and affects all currently supported versions. It will be fixed in: 1.4.2 and 1.0.8

Thank you to OSS-Fuzz for identifying this issue.
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist. This is a backport of a fix from ClamAV 1.3.0.

GitHub pull request

ClamAV 1.4 as Next Long-Term Stable (LTS)

2025-01-08T11:11:00.004-05:00

We are excited to announce that ClamAV 1.4 is now designated as our latest Long-Term Stable (LTS) release.

Previously, we planned to announce 1.5 as the next LTS version at the end of 2024. However, unforeseen challenges have delayed the 1.5 release, leading us to choose version 1.4 for long-term support. We apologize for any inconvenience that our delay in the announcement may have caused. The version support dates for ClamAV 1.4 are amended as follows:

Key Dates:

Initial 1.4 Release Date: August 15, 2024
Patch Versions Continue Until: August 15, 2027
DB Downloads Allowed Until: August 15, 2028

For specific details, please read the ClamAV EOL Policy.

Looking ahead, the beta version of ClamAV 1.5 will soon be available for community review. This version will focus on resolving FIPS mode compatibility issues for newer distributions, such as Red Hat Enterprise Linux 9. Stay tuned for further updates.

Thank you for your continued support.

ClamAV 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security patch versions published

2024-09-04T12:08:00.003-04:00

Today, we are publishing the 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security patch versions.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and (with exception to 0.103.12) through Docker Hub.

The images on Docker Hub may not be immediately available on release day.

Continue reading to learn what changed in each version.

1.4.1

ClamAV 1.4.1 is a critical patch release with the following fixes:

CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to Detlef for identifying this issue.
CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service (DoS) condition.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to OSS-Fuzz for identifying this issue.
Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.

1.3.2

ClamAV 1.3.2 is a patch release with the following fixes:

CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to Detlef for identifying this issue.
CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to OSS-Fuzz for identifying this issue.
Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
Fix unit test caused by expiring signing certificate.
- Backport of GitHub pull request
Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.
- Backport of GitHub pull request
Fixed an unaligned pointer dereference issue on select architectures. Fix courtesy of Sebastian Andrzej Siewior.
- Backport of GitHub pull request
Fixes to Jenkins CI pipeline.

For details, see GitHub pull request

1.0.7

ClamAV 1.0.7 is a patch release with the following fixes:

CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to Detlef for identifying this issue.
CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service (DoS) condition.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to OSS-Fuzz for identifying this issue.
Removed unused Python modules from freshclam tests including deprecated 'cgi' module that is expected to cause test failures in Python 3.13.
Fix unit test caused by expiring signing certificate.
- Backport of GitHub pull request
Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.
- Backport of GitHub pull request
Fixed an unaligned pointer dereference issue on select architectures. Fix courtesy of Sebastian Andrzej Siewior.
- Backport of GitHub pull request
Fixes to Jenkins CI pipeline.

For details, see GitHub pull request

0.103.12

ClamAV 0.103.12 is a patch release with the following fixes:

CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to Detlef for identifying this issue.
CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service condition.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to OSS-Fuzz for identifying this issue.
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
- GitHub pull request
Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update. Also added the new 'valhalla' database name to the list of optional databases in preparation for future work.
- Backport of GitHub pull request
Fixed an unaligned pointer dereference issue on select architectures. Fix courtesy of Sebastian Andrzej Siewior.

Backport of GitHub pull request

ClamAV 1.4.0 feature release and ClamAV bytecode compiler 1.4.0 release

2024-08-15T13:28:00.001-04:00

The ClamAV 1.4.0 feature release is now stable. We encourage everyone to download the latest version now from the ClamAV downloads page, on the GitHub Release page, and through Docker Hub*:

*The Docker images are built on release day and will be made available when they are ready.

We are also publishing ClamAV bytecode compiler version 1.4.0.

The ClamAV bytecode compiler release files are available for download on the GitHub Release page and through Docker Hub.

ClamAV platform support changes

We will no longer provide Linux 32-bit packages. With RHEL 7 reaching end-of-life, we had to upgrade our build hosts and selected Alma Linux 8. Alma Linux does not provide 32-bit images. ClamAV users on 32-bit platforms can still build from source.

We now provide ARM64 packages for Windows. We are not able to provide ARM64/aarch64 Linux packages for this release.

Regarding future versions

An expired signing certificate used to create one of the test files is causing feature test failures in previous versions (1.3.1, 1.0.6 LTS). This is only a test issue and does not impact ClamAV functionality or detection. We are preparing patch versions for the 1.3 and 1.0 feature releases to address the test issue.

The next LTS release will be announced later this year. It will likely be the feature release after 1.4.

The 0.103 LTS release will soon reach end-of-life for security fixes. Check out our recent blog post for full details.

Continue reading to learn what changed in these versions.

ClamAV 1.4.0

ClamAV 1.4.0 includes the following improvements and changes:

Major changes

Added support for extracting ALZ archives. The new ClamAV file type for ALZ archives is CL_TYPE_ALZ. Added a DCONF option to enable or disable ALZ archive support.
Tip: DCONF (Dynamic CONFiguration) is a feature that allows for some configuration changes to be made via ClamAV .cfg "signatures".
- GitHub pull request
Added support for extracting LHA/LZH archives. The new ClamAV file type for LHA/LZH archives is CL_TYPE_LHA_LZH. Added a DCONF option to enable or disable LHA/LZH archive support.
- GitHub pull request
Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
New ClamScan options:
```
--scan-image[=yes(*)/no]
--scan-image-fuzzy-hash[=yes(*)/no]
```
New ClamD config options:
```
ScanImage yes(*)/no
ScanImageFuzzyHash yes(*)/no
```
New libclamav scan options:
```
options.parse &= ~CL_SCAN_PARSE_IMAGE;
options.parse &= ~CL_SCAN_PARSE_IMAGE_FUZZY_HASH;
```
Added a DCONF option to enable or disable image fuzzy hashing support.
- GitHub pull request

Other improvements

Added cross-compiling instructions for targeting ARM64/aarch64 processors for Windows and Linux.
- GitHub pull request
Improved the Freshclam warning messages when being blocked or rate limited to include the Cloudflare Ray ID, which helps with issue triage.
- GitHub pull request
Removed unnecessary memory allocation checks when the size to be allocated is fixed or comes from a trusted source. We also renamed internal memory allocation functions and macros, so it is more obvious what each function does.
- GitHub pull request
Improved the Freshclam documentation to make it clear that the --datadir option must be an absolute path to a directory that already exists, is writable by Freshclam, and is readable by ClamScan and ClamD.
- GitHub pull request
Added an optimization to avoid calculating the file hash if the clean file cache has been disabled. The file hash may still be calculated as needed to perform hash-based signature matching if any hash-based signatures exist that target a file of the same size, or if any hash-based signatures exist that target "any" file size.
- GitHub pull request
Added an improvement to the SystemD service file for ClamOnAcc so that the service will shut down faster on some systems.
- GitHub pull request
Added a CMake build dependency on the version map files so that the build will re-run if changes are made to the version map files. Work courtesy of Sebastian Andrzej Siewior.
- GitHub pull request
Added an improvement to the CMake build so that the RUSTFLAGS settings are inherited from the environment. Work courtesy of liushuyu.
- GitHub pull request

Bug fixes

Silenced confusing warning message when scanning some HTML files.
- GitHub pull request
Fixed minor compiler warnings.
- GitHub pull request
Since the build system changed from Autotools to CMake, ClamAV no longer supports building with configurations where bzip2, libxml2, libz, libjson-c, or libpcre2 are not available. Libpcre is no longer supported in favor of libpcre2. In this release, we removed all the dead code associated with those unsupported build configurations.
- GitHub pull request
Fixed assorted typos. Patch courtesy of RainRat.
- GitHub pull request
Added missing documentation for the ClamScan --force-to-disk option.
- GitHub pull request
Fixed an issue where ClamAV unit tests would prefer an older libclamunrar_iface library from the install path, if present, rather than the recently compiled library in the build path.
- GitHub pull request
Fixed a build issue on Windows with newer versions of Rust. Also upgraded GitHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.
- GitHub pull request
Fixed an unaligned pointer dereference issue on select architectures. Fix courtesy of Sebastian Andrzej Siewior.
- GitHub pull request
Fixed a bug that prevented loading plaintext (non-CVD) signature files when using the --fail-if-cvd-older-than=DAYS / FailIfCvdOlderThan option. Fix courtesy of Bark.
- GitHub pull request

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

Bark
liushuyu
Sebastian Andrzej Siewior
RainRat

`ClamAV Bytecode Compiler 1.4.0`

➕ Upgrade bytecode compiler project to LLVM 16.

The bytecode compiler project now builds multiple shared object files, instead of just one with all of the passes. This is due to running with the "new" pass manager, instead of running with the legacy pass manager, as before. See https://llvm.org/docs/NewPassManager.html and https://blog.llvm.org/posts/2021-03-26-the-new-pass-manager/ for more details.
The bytecode compiler currently uses (deprecated) non-opaque pointers. Updating to all opaque pointers will be required for the next release. See https://llvm.org/docs/OpaquePointers.html for more information.

🌌 New Requirements:

LLVM 16
Clang 16

ClamAV 0.103 LTS End of Life Announcement

2024-08-07T09:55:00.000-04:00

The ClamAV 0.103 LTS release is nearing end-of-life (EOL) with regards to security vulnerability fix support from our team. This end of life date will be Sept. 14, 2024.

ClamAV 0.103 users will be able to update signatures from the official database mirror for an additional one year after the EOL date.

After Sept. 14, 2025, we may block ClamAV 0.103 from downloading signature updates.

We recommend that users update to the newest LTS release, ClamAV 1.0.6.

For users that want to upgrade to the newest non-LTS release, use ClamAV 1.3.1.

The most recent version of ClamAV can be found here: https://www.clamav.net/downloads

The following is a list of major changes available to users in the newest versions of ClamAV.

Since ClamAV 0.103, ClamAV 1.0 LTS adds:

· A new detection capability based on comparing image fuzzy hashes.

· [Windows] A feature to start clamd and freshclam as Windows services.

· [Windows] A feature to scan process memory with either clamscan or clamdscan.

· Signature database load progress bars for clamscan.

· Support for extracting images from OLE2-based Excel documents.

· The ability to use *.cat files with CRB signature rules to trust signed Windows executables.

· Support for decrypting read-only OLE2-based XLS files that are encrypted with the default password.

· Significant reliability improvements to the All-Match scanning mode.

· Multiple libclamav API improvements.

· And more!

Since ClamAV 1.0 LTS, ClamAV 1.3.1 adds:

· Support for extracting Universal Disk Format (UDF) partitions.

· Support for extracting ALZ archives.

· Support for extracting LHA/LZH archives.

· Support for extracting images embedded in HTML CSS<style> blocks.

· Support for extracting attachments found in Microsoft OneNote files.

· An option to customize the size of ClamAV's clean file cache.

· Effective removal of the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes. Note: This does not allow individual file size to exceed the 2 limit.

· The ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror.

· A new ClamScan and ClamD option to fail to load if the provided signature database is older than a given number of days.

· Multiple libclamav API improvements.

Users updating to the newest version of ClamAV can find helpful resource below and if you find you have a specific question, please join our Discord.

An assortment of installer packages for Mac (universal PKG installer), windows (MSI and ZIP installers), and Linux (DEB and RPM installers). These are available from:
https://www.clamav.net/downloads

https://github.com/Cisco-Talos/clamav/releases/

Alpine and Debian based Docker containers. These are published here:
https://hub.docker.com/u/clamav

Helpful documentation for compiling ClamAV:

- Linux: https://docs.clamav.net/manual/Installing/Installing-from-source-Unix.html

- Windows: https://docs.clamav.net/manual/Installing/Installing-from-source-Windows.html

- Reference documentation for compile options: https://github.com/Cisco-Talos/clamav/blob/main/INSTALL.md

- Instructions for cross-compiling from Linux x86_64 to Linux aarch64: https://github.com/Cisco-Talos/clamav/blob/main/INSTALL-cross-linux-arm64.md

- Instructions for cross-compiling from Windows x86_64 to Windows ARM64: https://github.com/Cisco-Talos/clamav/blob/main/INSTALL-cross-windows-arm64.md

For users of installer packages instructions can be found here: https://docs.clamav.net/manual/Installing.html#installing-with-an-installer

Further information about ClamAV EOL policy can be found here:
https://docs.clamav.net/faq/faq-eol.html

ClamAV 1.4.0 release candidate now available!

2024-05-07T13:45:00.002-04:00

The ClamAV 1.4.0 release candidate is now available.

You may find the source code and installers for this release on the clamav.net/downloads page or the ClamAV GitHub release page.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.4.0-rc.tar.gz" does not require an internet connection to build. All dependencies are included in this package. But if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the release candidate, but you can use the clamav:unstable or clamav:unstable_base tags.

The release candidate phase is expected to last two to three weeks before we publish the stable release or a second release candidate. Please take this time to evaluate ClamAV 1.4.0.

Please help us validate this release by providing feedback via the ClamAV mailing list or on our Discord.

ClamAV 1.4.0 includes the following improvements and changes:

Major changes

Added support for extracting ALZ archives. The new ClamAV file type for ALZ archives is CL_TYPE_ALZ. Added a DCONF option to enable or disable ALZ archive support.
Tip: DCONF (Dynamic CONFiguration) is a feature that allows for some configuration changes to be made via ClamAV .cfg "signatures".
- GitHub pull request
Added support for extracting LHA/LZH archives. The new ClamAV file type for LHA/LZH archives is CL_TYPE_LHA_LZH. Added a DCONF option to enable or disable LHA/LZH archive support.
- GitHub pull request
Added the ability to disable image fuzzy hashing, if needed. For context, image fuzzy hashing is a detection mechanism useful for identifying malware by matching images included with the malware or phishing email/document.
New ClamScan options:
```
--scan-image[=yes(*)/no]
--scan-image-fuzzy-hash[=yes(*)/no]
```
New ClamD config options:
```
ScanImage yes(*)/no
ScanImageFuzzyHash yes(*)/no
```
New libclamav scan options:
```
options.parse &= ~CL_SCAN_PARSE_IMAGE;
options.parse &= ~CL_SCAN_PARSE_IMAGE_FUZZY_HASH;
```
Added a DCONF option to enable or disable image fuzzy hashing support.
- GitHub pull request

Other improvements

Added cross-compiling instructions for targeting ARM64/aarch64 processors for Windows and Linux.
- GitHub pull request
Improved the Freshclam warning messages when being blocked or rate limited so as to include the Cloudflare Ray ID, which helps with issue triage.
- GitHub pull request
Removed unnecessary memory allocation checks when the size to be allocated is fixed or comes from a trusted source. We also renamed internal memory allocation functions and macros, so it is more obvious what each function does.
- GitHub pull request
Improved the Freshclam documentation to make it clear that the --datadir option must be an absolute path to a directory that already exists, is writable by Freshclam, and is readable by ClamScan and ClamD.
- GitHub pull request
Added an optimization to avoid calculating the file hash if the clean file cache has been disabled. The file hash may still be calculated as needed to perform hash-based signature matching if any hash-based signatures exist that target a file of the same size, or if any hash-based signatures exist that target "any" file size.
- GitHub pull request
Added an improvement to the SystemD service file for ClamOnAcc so that the service will shut down faster on some systems.
- GitHub pull request

Bug fixes

Silenced confusing warning message when scanning some HTML files.
- GitHub pull request
Fixed minor compiler warnings.
- GitHub pull request
Since the build system changed from Autotools to CMake, ClamAV no longer supports building with configurations where bzip2, libxml2, libz, libjson-c, or libpcre2 are not available. Libpcre is no longer supported in favor of libpcre2. In this release, we removed all the dead code associated with those unsupported build configurations.
- GitHub pull request
Fixed assorted typos. Patch courtesy of RainRat.
- GitHub pull request
Added missing documentation for the ClamScan --force-to-disk option.
- GitHub pull request
Fixed an issue where ClamAV unit tests would prefer an older libclamunrar_iface library from the install path, if present, rather than the recently compiled library in the build path.
- GitHub pull request

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

RainRat

ClamAV 1.3.1, 1.2.3, 1.0.6 patch versions published

2024-04-17T13:29:00.000-04:00

Today, we are publishing the 1.3.1, 1.2.3, and 1.0.6 security patch versions.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub.

The images on Docker Hub may not be immediately available on release day.

Continue reading to learn what changed in each version.

1.3.1

ClamAV 1.3.1 is a critical patch release with the following fixes:

CVE-2024-20380: Fixed a possible crash in the HTML file parser that could cause a denial-of-service (DoS) condition.
This issue affects version 1.3.0 only and does not affect prior versions.
Thank you to Błażej Pawłowski for identifying this issue.
- GitHub pull request
Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.
- GitHub pull request
Fixed a bug causing some text to be truncated when converting from UTF-16.
- GitHub pull request
Fixed assorted complaints identified by Coverity static analysis.
- GitHub pull request
Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.
- GitHub pull request
Added the new 'valhalla' database name to the list of optional databases in preparation for future work.
- GitHub pull request
Added symbols to the libclamav.map file to enable additional build configurations.
Patch courtesy of Neil Wilson.
- GitHub pull request

1.2.3

ClamAV 1.2.3 is a critical patch release with the following fixes:

Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.
- GitHub pull request
Fixed a bug causing some text to be truncated when converting from UTF-16.
- GitHub pull request
Fixed assorted complaints identified by Coverity static analysis.
- GitHub pull request
Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.
- GitHub pull request
Added the new 'valhalla' database name to the list of optional databases in preparation for future work.
- GitHub pull request
Silenced a warning "Unexpected early end-of-file" that occured when scanning some PNG files.
- GitHub pull request

1.0.6

ClamAV 1.0.6 is a critical patch release with the following fixes:

Updated select Rust dependencies to the latest versions. This resolved Cargo audit complaints and included PNG parser bug fixes.
- GitHub pull request
Fixed a bug causing some text to be truncated when converting from UTF-16.
- GitHub pull request
Fixed assorted complaints identified by Coverity static analysis.
- GitHub pull request
Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam config option to be pruned and then re-downloaded with every update.
- GitHub pull request
Added the new 'valhalla' database name to the list of optional databases in preparation for future work.
- GitHub pull request
Silenced a warning "Unexpected early end-of-file" that occured when scanning some PNG files.
- GitHub pull request

ClamAV 1.3.0 feature release and 1.2.2, 1.0.5 security patch release!

2024-02-07T11:48:00.002-05:00

The ClamAV 1.3.0 feature release is now stable!

Today, we are also publishing the 1.2.2 and 1.0.5 security patch versions.

ClamAV 1.1 is past EOL for security fixes and will not receive an update. Switch to the 1.0 LTS, 1.2, or 1.3 versions for continued support.

The release files are available for download on the ClamAV downloads page, on the Github Release page, and through Docker Hub*:

*The Docker images are built on release day and may not be available until later in the day.

Continue reading to learn what changed in each version.

1.3.0

ClamAV 1.3.0 includes the following improvements and changes:

Major changes

Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled using one of the following options:
a. The clamscan command line option: --scan-onenote=no,
b. The clamd.conf config option: ScanOneNote no,
c. The libclamav scan option options.parse &= ~CL_SCAN_PARSE_ONENOTE;,
d. A signature change to the daily.cfg dynamic configuration (DCONF).

GitHub pull request

Other improvements

Fixed issue when building ClamAV on the Haiku (BeOS-like) operating system. Patch courtesy of Luca D'Amico
- GitHub pull request
ClamD: When starting, ClamD will now check if the directory specified by TemporaryDirectory in clamd.conf exists. If it doesn't, ClamD will print an error message and will exit with exit code 1. Patch courtesy of Andrew Kiggins.
- GitHub pull request
CMake: If configured to build static libraries, CMake will now also install the libclamav_rust, libclammspack, libclamunrar_iface, and libclamunrar static libraries required by libclamav.
Note: These libraries are all linked into the clamscan, clamd, sigtool, and freshclam programs, which is why they did not need to be installed to function. However, these libraries would be required if you wish to build some other program that uses the libclamav static library.
Patch courtesy of driverxdw.
- GitHub pull request
Added file type recognition for compiled Python (`.pyc`) files.
The file type appears as a string parameter for these callback functions:
- clcb_pre_cache
- clcb_pre_scan
- clcb_file_inspection
When scanning a `.pyc` file, the `type` parameter will now show
"CL_TYPE_PYTHON_COMPILED" instead of "CL_TYPE_BINARY_DATA".

GitHub pull request

Improved support for decrypting PDFs with empty passwords.

GitHub pull request

Assorted minor improvements and typo fixes.

Bug fixes

Fixed a warning when scanning some HTML files.
- GitHub pull request
Fixed an issue decrypting some PDF's with an empty password.
- GitHub pull request
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.

GitHub pull request

ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.
Patch courtesy of gsuehiro.

GitHub pull request

Fixed a possible crash when processing VBA files on HP-UX/IA 64bit. Patch courtesy of Albert Chin-A-Young.

GitHub pull request

ClamConf: Fixed an issue printing `MaxScanSize` introduced with the change to allow a `MaxScanSize` greater than 4 GB.
Fix courtesy of teoberi.

GitHub pull request

Fixed an issue building a ClamAV RPM in some configurations.
The issue was caused by faulty CMake logic that intended to create an empty database directory during the installation.

GitHub pull request

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

Albert Chin-A-Young
Andrew Kiggins
driverxdw
gsuehiro
Luca D'Amico
RainRat
teoberi

1.2.2 and 1.0.5

ClamAV 1.2.2 and ClamAV 1.0.5 are critical patch versions with the following fixes:

CVE-2024-20290: Fixed a possible heap overflow read bug in the OLE2 file parser that could cause a denial-of-service (DoS) condition.

Thank you to OSS-Fuzz for identifying this issue.

Affected versions:

1.0.0 through 1.0.4 (LTS)
1.1 (all patch versions)
1.2.0 and 1.2.1

CVE-2024-20328: Fixed a possible command injection vulnerability in the "VirusEvent" feature of ClamAV's ClamD service.

To fix this issue, we disabled the '%f' format string parameter. ClamD administrators may continue to use the `CLAM_VIRUSEVENT_FILENAME` environment variable, instead of '%f'. But you should do so only from within an executable, such as a Python script, and not directly in the clamd.conf "VirusEvent" command.

Thank you to Amit Schendel for identifying this issue.

Affected versions:

0.104 (all patch versions)
0.105 (all patch versions)
1.0.0 through 1.0.4 (LTS)
1.1 (all patch versions)
1.2.0 and 1.2.1

ClamAV 1.3.0 Second Release Candidate now available!

2024-01-24T15:31:00.001-05:00

We are excited to announce the ClamAV 1.3.0 release candidate.

You can find the source code and installers for this release on the clamav.net/downloads page or the ClamAV GitHub release page.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.3.0-rc2.tar.gz" does not require an internet connection to build. All dependencies are included in this package. But if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the release candidate, but you can use these tags:

clamav/clamav:unstable
clamav/clamav:unstable_base
clamav/clamav-debian:unstable
clamav/clamav-debian:unstable_base

This release candidate phase is expected to last two weeks before we publish the stable release. Please take this time to evaluate ClamAV 1.3.0.

Please help us validate this release by providing feedback via the ClamAV mailing list or our Discord.

Changes since the first release candidate include:

Improved support for decrypting PDFs with empty passwords.

GitHub pull request

ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan.
Patch courtesy of gsuehiro.

GitHub pull request

ClamConf: Fixed an issue printing `MaxScanSize` introduced with the change to allow a `MaxScanSize` greater than 4 GB.
Fix courtesy of teoberi.

GitHub pull request

Fixed an issue building a ClamAV RPM in some configurations.
The issue was caused by faulty CMake logic that intended to create an empty database directory during the installation.

GitHub pull request

You can find the full list of changes and improvements in the blog post for the first release candidate.

ClamAV Debian multi-Arch Docker images now available!

2024-01-22T13:01:00.000-05:00

We now offer official ClamAV docker images based on `debian:11-slim`.

In addition to offering an alternative to the original Alpine Linux images, the new images are multi-arch images supporting `linux/amd64`, `linux/arm64`, and `linux/ppc64le`.

ClamAV's Alpine-based and Debian-based Docker images are now built weekly to pick up security fixes in the base images.

Check it out here.

ClamAV 1.3.0 release candidate now available!

2023-12-15T11:09:00.006-05:00

The ClamAV 1.3.0 release candidate is now available.

You may find the source code and installers for this release on the clamav.net/downloads page or the ClamAV GitHub release page.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.3.0-rc.tar.gz" does not require an internet connection to build. All dependencies are included in this package. But if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the release candidate, but you can use the clamav:unstable or clamav:unstable_base tags.

The release candidate phase is expected to last two to three weeks before we publish the stable release or a second release candidate. Please take this time to evaluate ClamAV 1.3.0.

Please help us validate this release by providing feedback via the ClamAV mailing list or on our Discord.

ClamAV 1.3.0 includes the following improvements and changes:

Major changes

Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled using one of the following options:
a. The clamscan command line option: --scan-onenote=no,
b. The clamd.conf config option: ScanOneNote no,
c. The libclamav scan option options.parse &= ~CL_SCAN_PARSE_ONENOTE;,
d. A signature change to the daily.cfg dynamic configuration (DCONF).

GitHub pull request

Other improvements

Fixed issue when building ClamAV on the Haiku (BeOS-like) operating system. Patch courtesy of Luca D'Amico
- GitHub pull request
ClamD: When starting, ClamD will now check if the directory specified by TemporaryDirectory in clamd.conf exists. If it doesn't, ClamD will print an error message and will exit with exit code 1. Patch courtesy of Andrew Kiggins.
- GitHub pull request
CMake: If configured to build static libraries, CMake will now also install the libclamav_rust, libclammspack, libclamunrar_iface, and libclamunrar static libraries required by libclamav.
Note: These libraries are all linked into the clamscan, clamd, sigtool, and freshclam programs, which is why they did not need to be installed to function. However, these libraries would be required if you wish to build some other program that uses the libclamav static library.
Patch courtesy of driverxdw.
- GitHub pull request
Added file type recognition for compiled Python (`.pyc`) files.
The file type appears as a string parameter for these callback functions:
- `clcb_pre_cache`
- `clcb_pre_scan`
- `clcb_file_inspection`
When scanning a `.pyc` file, the `type` parameter will now show
"CL_TYPE_PYTHON_COMPILED" instead of "CL_TYPE_BINARY_DATA".

GitHub pull request

Assorted minor improvements and typo fixes.

Bug fixes

Fixed a warning when scanning some HTML files.
- GitHub pull request
Fixed an issue decrypting some PDF's with an empty password.
- GitHub pull request
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
- GitHub pull request
Fixed a possible crash when processing VBA files on HP-UX/IA 64bit. Patch courtesy of Albert Chin-A-Young.
- GitHub pull request

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

Albert Chin-A-Young
Andrew Kiggins
driverxdw
Luca D'Amico
RainRat

ClamAV 1.2.1, 1.1.3, 1.0.4, 0.103.11 patch versions published

2023-10-25T13:36:00.005-04:00

Today, we are publishing the 1.2.1, 1.1.3, 1.0.4, and 0.103.11 security patch versions.

The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub.

Continue reading to learn what changed in each version.

1.2.1

ClamAV 1.2.1 is a patch release with the following fixes:

Eliminate security warning about unused "atty" dependency.
- GitHub pull request.
Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
- GitHub pull request.
Build system: Fix link error with Clang/LLVM/LLD version 17. Patch courtesy of Yasuhiro Kimura.
- GitHub pull request.
Fix alert-exceeds-max feature for files > 2GB and < max-filesize.
- GitHub pull request.

Special thanks to Yasuhiro Kimura for code contributions and bug reports.

1.1.3

ClamAV 1.1.3 is a patch release with the following fixes:

Eliminate security warning about unused "atty" dependency.
- GitHub pull request.
Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
- GitHub pull request.
Windows: libjson-c 0.17 compatibility fix with ssize_t type definition.
- GitHub pull request.
Build system: Fix link error with Clang/LLVM/LLD version 17. Patch courtesy of Yasuhiro Kimura.
- GitHub pull request.
Fix alert-exceeds-max feature for files > 2GB and < max-filesize.
- GitHub pull request.

Special thanks to Yasuhiro Kimura for code contributions and bug reports.

1.0.4

ClamAV 1.0.4 is a patch release with the following fixes:

Eliminate security warning about unused "atty" dependency.
- GitHub pull request.
Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
- GitHub pull request.
Windows: libjson-c 0.17 compatibility fix with ssize_t type definition.
- GitHub pull request.
Freshclam: Removed a verbose warning printed for each Freshclam HTTP request.
- GitHub pull request.
Build system: Fix link error with Clang/LLVM/LLD version 17. Patch courtesy of Yasuhiro Kimura.
- GitHub pull request.
Fix alert-exceeds-max feature for files > 2GB and < max-filesize.
- GitHub pull request.

Special thanks to Yasuhiro Kimura for code contributions and bug reports.

0.103.11

ClamAV 0.103.11 is a patch release with the following fixes:

Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
- GitHub pull request.
Windows: libjson-c 0.17 compatibility fix with ssize_t type definition.
- GitHub pull request.
Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.

GitHub pull request.

ClamAV 1.2.0 feature version and 1.1.2, 1.0.3, 0.103.10 patch versions published

2023-08-28T17:15:00.002-04:00

The ClamAV 1.2.0 feature release is now stable and available for download on the ClamAV downloads page, on the Github Release page, and through Docker Hub.

Today, we are also publishing the 1.1.2, 1.0.3, and 0.103.10 security patch versions. You may be surprised about the impromptu patch release. Indeed, we just published patch versions earlier this month. Unfortunately, a recent CVE for the UnRAR* library has prompted us to prepare these additional updates.

We strongly encourage everyone to upgrade to one of these versions.

The release files for the patch versions are also available for download on the ClamAV downloads page, on the Github Release page, and through Docker Hub. Because ClamAV 1.2.0 is now the latest release, the release files for version 1.1.2 will be found under the "Previous Stable Releases" section of the ClamAV.net downloads page.

*UnRAR is an open source library by the makers of WinRAR which we bundle with ClamAV under the name "libclamunrar". We are concerned that ClamAV may be affected by CVE-2023-40477. Special thanks to Jan Pokorny, at St. Anne's University Hospital, for identifying its potential impact on ClamAV and reporting it to us.

Continue reading to learn what changed in each version.

1.2.0

ClamAV 1.2.0 includes the following improvements and changes:

Major changes

Added support for extracting Universal Disk Format (UDF) partitions.
Specifically, this version adds support for the Beginning Extended Area Descriptor (BEA01) type of UDF files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/941
Added an option to customize the size of ClamAV's clean file cache.
Increasing the size of the clean file cache may improve scan performance but will require more RAM. The cache size value should be a square number or will be rounded up to the nearest square number.
The cache size option for clamd and clamscan is --cache-size. Alternatively, you can customize the cache size for ClamD by setting CacheSize in clamd.conf.
Patch courtesy of Craig Andrews.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/882
Introduced a SystemD timer for running Freshclam updates, without sending Freshclam into the background. This takes the "burden of timing the updates" from Freshclam and puts it onto SystemD. The timer can be activated, audited, and the logs inspected:
```
sudo systemctl enable --now clamav-freshclam-once.timer
sudo systemctl list-timers
sudo systemctl status clamav-freshclam-once.timer
sudo systemctl status clamav-freshclam-once.service
journalctl -u clamav-freshclam-once.service
```
If you want a different update interval you can edit the timer unit file:
```
sudo systemctl edit clamav-freshclam-once.timer
```
Patch courtesy of Nils Werner.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/962
Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
Introduced the ability to suffix the MaxScanSize and other config file size options with a "G" or "g" for the number of gigabytes. For example, for ClamD you may now specify MaxScanSize 10G in clamd.conf. And for ClamScan, you may now specify --max-scansize=10g.
The MaxFileSize is still limited internally in ClamAV to 2 gigabytes. Any file, or embedded file, larger than 2GB will be skipped. You may use clamscan --alert-exceeds-max, or the clamd.conf option AlertExceedsMax yes to tell if a scan is not completed because of the scan limits.
Patch courtesy of matthias-fratz-bsz.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/945
Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror by setting the following environment variables:
- FRESHCLAM_CLIENT_CERT: May be set to the path of a file (PEM) containing the client certificate.
- FRESHCLAM_CLIENT_KEY: May be set to the path of a file (PEM) containing the client private key.
- FRESHCLAM_CLIENT_KEY_PASSWD: May be set to a password for the client key PEM file, if it is password protected.
Patch courtesy of jedrzej.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/955

Other improvements

Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/938
CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain.
The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/970
The suggested path for the clamd.pid and clamd.sock file in the sample configs have been updated to reflect the recommended locations for these files in the Docker images. These are:
- /run/clamav/clamd.pid
- /run/clamav/clamd.sock
For consistency, it now specifies clamd.sock instead of clamd.socket.
Patch courtesy of computersalat.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/931

Bug fixes

Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/934
Fixed a possible buffer over-read bug when unpacking PE files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/927
Removed a warning message showing the HTTP response codes during the Freshclam database update process.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/935
Added missing command line options to the ClamD and ClamAV-Milter --help message and manpages.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/936
ClamOnAcc: Fixed error message when using --wait without --ping option. Patch courtesy of Răzvan Cojocaru.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/984
Fixed an assortment of code quality issues identified by Coverity:
- GitHub pull requests:
  - https://github.com/Cisco-Talos/clamav/pull/989
  - https://github.com/Cisco-Talos/clamav/pull/998
Windows: Fixed a build issue with the CMake-Rust integration regarding detecting native static libraries that caused builds to fail with Rust version 1.70 and newer.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/992
Fixed a bounds check issue in the PDF parser that may result in a 1-byte buffer over read but does not cause a crash.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/988
Upgraded the bundled UnRAR library (libclamunrar) to version 6.2.10.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1008
Fixed a compatibility issue with libjson-c version 0.17.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1002

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

computersalat
Craig Andrews
jedrzej
matthias-fratz-bsz
Nils Werner
Răzvan Cojocaru

1.1.2

ClamAV 1.1.2 is a critical patch release with the following fixes:

Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1011

1.0.3

ClamAV 1.0.3 is a critical patch release with the following fixes:

Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1010

0.103.10

ClamAV 0.103.10 is a critical patch release with the following fixes:

Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1009

ClamAV 1.1.1, 1.0.2, 0.103.9 patch versions published

2023-08-15T17:39:00.000-04:00

Today, we are releasing the following critical patch versions for ClamAV:

1.1.1
1.0.2
0.103.9

ClamAV 0.105 and 0.104 have reached end-of-life according to the ClamAV’s End of Life (EOL) policy and will not be patched.

The release files are available for download on ClamAV.net, on the Github Release page, and through Docker Hub.

Note: We observed an issue building ClamAV on Windows using the recently released libjson-c version 0.17. If you are building ClamAV for Windows, you should use libjson-c version 0.16 or prior.

1.1.1

ClamAV 1.1.1 is a critical patch release with the following fixes:

CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/997

Fixed a build issue on Windows when using Rust version 1.70 or newer.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/994

CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/972

Removed a warning message showing the HTTP response codes during the Freshclam database update process.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/939

Special thanks to the following people for code contributions and bug reports:

Steve Smith

1.0.2

ClamAV 1.0.2 is a critical patch release with the following fixes:

CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
CVE-2023-20212 Fixed a possible denial of service vulnerability in the AutoIt file parser. This issue affects versions 1.0.1 and 1.0.0. This issue does not affect version 1.1.0.
Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/996

Fixed a build issue on Windows when using Rust version 1.70 or newer.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/993

CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/973

Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/952

Fixed an issue so that ClamAV correctly removes temporary files generated by the VBA and XLM extraction modules so that the files are not leaked in patched versions of ClamAV where temporary files are written directly to the temp-directory instead of writing to a unique subdirectory.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/900

Set Git attributes to prevent Git from altering line endings for bundled Rust libraries. Third-party Rust libraries are bundled in the ClamAV release tarball. We do not commit them to our own Git repository, but community package maintainers may now store the tarball contents in Git. The Rust build system verifies the library manifest, and this change ensures that the hashes are correct. Improvement courtesy of Nicolas R.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/856

Fixed two bugs that would cause Freshclam to fail update when applying a CDIFF database patch if that patch adds a file to the database archive or removes a file from the database archive. This bug also caused Sigtool to fail to create such a patch.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/901

Special thanks to the following people for code contributions and bug reports:

Nicolas R.
Steve Smith

0.103.9

ClamAV 0.103.9 is a critical patch release with the following fixes:

CVE-2023-20197 Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
Fixed compiler warnings that may turn into errors in Clang 16. Patch courtesy of Michael Orlitzky.

GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/747

Special thanks to the following people for code contributions and bug reports:

Michael Orlitzky
Steve Smith

ClamAV 1.2.0 release candidate now available

2023-08-04T12:52:00.000-04:00

We are excited to announce the ClamAV 1.2.0 release candidate.

You may find the source code and installers for this release on the clamav.net/downloads page or the ClamAV GitHub release page.

Tip: If you are downloading the source from the GitHub release page, the package labeled "clamav-1.2.0-rc.tar.gz" does not require an internet connection to build. All dependencies are included in this package. But if you download the ZIP or TAR.GZ generated by GitHub, located at the very bottom, then an internet connection will be required during the build to download additional Rust dependencies.

For Docker users, there is no specific Docker tag for the release candidate, but you can use the clamav:unstable or clamav:unstable_base tags.

The release candidate phase is expected to last two to three weeks before we publish the stable release or a second release candidate. Please take this time to evaluate ClamAV 1.2.0.

Please help us validate this release by providing feedback via the ClamAV mailing list or on our Discord.

ClamAV 1.2.0 includes the following improvements and changes:

Major changes

Added support for extracting Universal Disk Format (UDF) partitions.
Specifically, this version adds support for the Beginning Extended Area Descriptor (BEA01) type of UDF files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/941
Added an option to customize the size of ClamAV's clean file cache.
Increasing the size of the clean file cache may improve scan performance but will require more RAM. The cache size value should be a square number or will be rounded up to the nearest square number.
The cache size option for clamd and clamscan is --cache-size. Alternatively, you can customize the cache size for ClamD by setting CacheSize in clamd.conf.
Patch courtesy of Craig Andrews.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/882
Introduced a SystemD timer for running Freshclam updates, without sending Freshclam into the background. This takes the "burden of timing the updates" from Freshclam and puts it onto SystemD. The timer can be activated, audited, and the logs inspected:
```
sudo systemctl enable --now clamav-freshclam-once.timer
sudo systemctl list-timers
sudo systemctl status clamav-freshclam-once.timer
sudo systemctl status clamav-freshclam-once.service
journalctl -u clamav-freshclam-once.service
```
If you want a different update interval you can edit the timer unit file:
```
sudo systemctl edit clamav-freshclam-once.timer
```
Patch courtesy of Nils Werner.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/962
Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes.
Introduced the ability to suffix the MaxScanSize and other config file size options with a "G" or "g" for the number of gigabytes. For example, for ClamD you may now specify MaxScanSize 10G in clamd.conf. And for ClamScan, you may now specify --max-scansize=10g.
The MaxFileSize is still limited internally in ClamAV to 2 gigabytes. Any file, or embedded file, larger than 2GB will be skipped. You may use clamscan --alert-exceeds-max, or the clamd.conf option AlertExceedsMax yes to tell if a scan is not completed because of the scan limits.
Patch courtesy of matthias-fratz-bsz.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/945
Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror by setting the following environment variables:
- FRESHCLAM_CLIENT_CERT: May be set to the path of a file (PEM) containing the client certificate.
- FRESHCLAM_CLIENT_KEY: May be set to the path of a file (PEM) containing the client private key.
- FRESHCLAM_CLIENT_KEY_PASSWD: May be set to a password for the client key PEM file, if it is password protected.
Patch courtesy of jedrzej.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/955

Other improvements

Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/938
CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain.
The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/970
The suggested path for the clamd.pid and clamd.sock file in the sample configs have been updated to reflect the recommended locations for these files in the Docker images. These are:
- /run/clamav/clamd.pid
- /run/clamav/clamd.sock
For consistency, it now specifies clamd.sock instead of clamd.socket.
Patch courtesy of computersalat.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/931

Bug fixes

Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/934
Fixed a possible buffer over-read bug when unpacking PE files.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/927
Removed a warning message showing the HTTP response codes during the Freshclam database update process.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/935
Added missing command line options to the ClamD and ClamAV-Milter --help message and manpages.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/936
ClamOnAcc: Fix error message when using --wait without --ping option. Patch courtesy of Răzvan Cojocaru.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/984

Acknowledgments

Special thanks to the following people for code contributions and bug reports:

computersalat
Craig Andrews
jedrzej
matthias-fratz-bsz
Nils Werner
Răzvan Cojocaru

Shutting down old ClamAV Bugzilla

2023-06-09T09:06:00.013-04:00

ClamAV will shut down the old ClamAV Bugzilla server in July.

Users who have any outstanding Bugzilla reports should move them to GitHub Issues as soon as possible.

We disabled new tickets in Bugzilla in December 2021 in favor of GitHub Issues for all new ClamAV bug reports and a new process for reporting vulnerabilities as defined by a new security policy. As it has now been 18 months since the switch to GitHub Issues, we have decided to shut down our old Bugzilla.

We plan to take the Bugzilla server off the internet sometime after July 1 and keep it as an internal reference for our development team. It will no longer be accessible to the public.

ClamAV® blog

ClamAV 1.5.2 and 1.4.4 security patch versions published

1.5.2

1.4.4

ClamAV Signature Retirement

ClamAV Signature Retirement Announcement

ClamAV 1.5.1 patch version published

ClamAV 1.5.0 released!

Major changes

Other improvements

Bug fixes

Acknowledgments

Special thanks to the following people for code contributions and bug reports:Andrew Watkinsb1tgChaoticByteFrederick SellKamathForAIXMark Carey at SAPMaxim SuhanovPino Toscanorma-xShivam7-1Sophie0x2ETITAN TeamuserwithsYoann Lecuyer

ClamAV 1.5.0 release candidate now available!

Major changes

Other improvements

Bug fixes

Acknowledgments

ClamAV 1.4.3 and 1.0.9 security patch versions published

1.4.3

1.0.9

ClamAV 1.5.0 beta now available!

Major changes

Other improvements

Bug fixes

Acknowledgments

Advance notice: End of Life for ClamAV 0.103 database updates

ClamAV 1.4.2 and 1.0.8 security patch versions published

1.4.2

1.0.8

ClamAV 1.4 as Next Long-Term Stable (LTS)

ClamAV 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security patch versions published

1.4.1

1.3.2

1.0.7

0.103.12

ClamAV 1.4.0 feature release and ClamAV bytecode compiler 1.4.0 release

ClamAV platform support changes

Regarding future versions

ClamAV 1.4.0

Major changes

Other improvements

Bug fixes

Acknowledgments

ClamAV Bytecode Compiler 1.4.0

ClamAV 0.103 LTS End of Life Announcement

ClamAV 1.4.0 release candidate now available!

Major changes

Other improvements

Bug fixes

Acknowledgments

ClamAV 1.3.1, 1.2.3, 1.0.6 patch versions published

1.3.1

1.2.3

1.0.6

ClamAV 1.3.0 feature release and 1.2.2, 1.0.5 security patch release!

1.3.0

Major changes

Other improvements

Bug fixes

Acknowledgments

1.2.2 and 1.0.5

ClamAV 1.3.0 Second Release Candidate now available!

ClamAV Debian multi-Arch Docker images now available!

ClamAV 1.3.0 release candidate now available!

Major changes

Other improvements

Bug fixes

Acknowledgments

ClamAV 1.2.1, 1.1.3, 1.0.4, 0.103.11 patch versions published

1.2.1

1.1.3

1.0.4

0.103.11

ClamAV 1.2.0 feature version and 1.1.2, 1.0.3, 0.103.10 patch versions published

1.2.0

Major changes

Other improvements

Bug fixes

Acknowledgments

Special thanks to the following people for code contributions and bug reports:
Andrew Watkins
b1tg
ChaoticByte
Frederick Sell
KamathForAIX
Mark Carey at SAP
Maxim Suhanov
Pino Toscano
rma-x
Shivam7-1
Sophie0x2E
TITAN Team
userwiths
Yoann Lecuyer

`ClamAV Bytecode Compiler 1.4.0`