ClamAV: baixar versions anteriors

ClamAV 1.5.4 is a patch release with the following fixes:
- CVE-2026-20337:
Fixed ZIP catalogue capacity tracking that could write beyond a heap
allocation while indexing local file headers.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying
this issue.
- CVE-2026-20345:
Fixed an indexing error while converting GPT partition names that could
read or write beyond a stack-allocated partition entry.
This issue affects ClamAV 0.98.2 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
of Tencent Xuanwu Lab for identifying this issue.
- CVE-2026-20339:
Fixed an integer overflow in the PESpin unpacker that could allocate an
undersized buffer and then write beyond it while rebuilding a PE file.
This issue affects ClamAV 0.90 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Feng Xue and, independently, Yazdan Soltani for identifying
this issue.
- CVE-2026-20338:
Fixed ownership handling while merging ZIP catalogue records that could
cause an invalid free while scanning a malformed archive.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for
identifying this issue.
- CVE-2026-20346:
Fixed an integer underflow in the PDF parser that could cause a crash while
reading a malformed hex string.
This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Tristan (@TristanInSec) for identifying this issue.
- CVE-2026-20347:
Fixed undefined behavior and integer overflow in the Mach-O parser that
could cause a crash while scanning a malformed Mach-O file.
This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through
1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Tristan (@TristanInSec) for identifying this issue.
- CVE-2026-20348:
Fixed XAR parser size handling that could request an excessive allocation
or exceed scan limits while decompressing a malformed table of contents.
This issue affects ClamAV 0.98.1 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to leduckhuong for identifying this issue.
- CVE-2025-8088:
Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
The fix rejects path separators in NTFS alternate data stream names to
prevent extraction outside ClamAV's temporary scan directory on Windows.
This issue affects ClamAV 0.101.0 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Yazdan Soltani for identifying that this issue affects ClamAV.
- Fixed thread-safety issues in the clamd STATS command that could disclose
process memory or crash the daemon while scans and STATS requests run
concurrently. Also fixed partial socket-write handling used for large STATS
responses.
This issue affects ClamAV 0.95 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
- FreeBSD: Restored support for safe quarantine move and remove actions while
preserving protection against source-path replacement races.
This issue affects ClamAV 1.4.5 and 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
- Fixed an OpenSSL library-context leak in legacy hashing helpers when a
requested message digest cannot be fetched, such as when the default
provider is unavailable in a FIPS-enabled environment.
This issue affects ClamAV 1.5.0 through 1.5.3.
The fix is included in 1.5.4.
- Upgraded the Rust crossbeam-epoch dependency to resolve the
RUSTSEC-2026-0204 advisory.

ClamAV 1.5.3 is a patch release with the following fixes:
- CVE-2026-20217:
Fixed a bug in the PESpin unpacker cleanup path that could free pointers
into the scanned file buffer and crash the scanner.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
as 2005.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
of Tencent Xuanwu Lab for identifying this issue.
- CVE-2026-20213:
Fixed an integer overflow in PE rebuild size calculations that could be
reached through a malformed Aspack-packed PE file and lead to a heap buffer
overflow write.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
as 2007.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
this issue.
- CVE-2026-20216:
Fixed an InstallShield archive extraction limit bypass that could write far
more temporary data than intended and exhaust temporary storage.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
as 2009.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Mizu for identifying this issue.
- CVE-2026-20214:
Fixed an FSG unpacker loop underflow that could write past the section array
while scanning a malformed PE file.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back
as 2004.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
this issue.
- CVE-2026-20243:
Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
to panic, abort the scanner, or skip expected scan-limit handling.
This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Yazdan Soltani for identifying this issue.
- CVE-2026-20215:
Fixed a 7z parser substream count overflow that could under-allocate parser
metadata arrays and write past them while reading a malformed archive.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Trail of Bits, in collaboration with Anthropic, for identifying
this issue.
- CVE-2026-20244:
Fixed 32-bit DMG parser size checks that could let a short mish stripe table
pass validation and crash 32-bit scanner builds.
This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including
1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit
builds.
The fix is included in 1.5.3 and 1.4.5.
Thank you to Stanley John Tobias for identifying this issue.
- Hardened clamscan, clamdscan, and clamonacc quarantine actions against
time-of-check/time-of-use races that could redirect copied, moved, or removed
files under unsafe quarantine directory configurations.
Thank you to Hiroki Imai from Ricerca Security, Inc. for identifying this
issue.
- Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
resolve CVE-2026-41676.
- Raised the minimum required CMake version to 3.17 to fix Linux builds with
libcurl v8.21.0 when linking static library dependencies.
- Metadata preclass scans now run before the final scan verdict.
- ClamOnAcc: Fixed errors when recursively excluded paths are children of an
included path.
- ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
in the same bucket.
These fixes are courtesy of sharkautarch.

ClamAV 1.5.2 is a patch release with the following fixes:
- CVE-2026-20031:
Fixed an error handling bug in the HTML file parser that may crash the program
and cause a denial-of-service (DoS) condition.
This issue was introduced in version 1.1.0.
The fix is included in 1.5.2 and 1.4.4.
- Fixed a possible infinite loop when scanning some JPEG files by upgrading
affected ClamAV dependency, a Rust image library.
Unfortunately, this change requires a newer Rust compiler for ClamAV.
The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.
- Fixed a possible crash on Windows when scanning some files while using the
LeaveTemporaryFiles and TemporaryDirectory features.
- The CVD verification process will now ignore certificate files in the CVD
certs directory when the user lacks read permissions.
- Freshclam: Fixed CLD verification bug with PrivateMirror option.
- Upgraded the Rust bytes dependency to a newer version to resolve the
RUSTSEC-2026-0007 advisory.
- Fixed a possible crash caused by invalid pointer alignment on some platforms.
This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.

ClamAV 1.5.1 is a patch release with the following fixes:
- Fixed a significant performance issue when scanning some PE files.
- Fixed an issue recording file entries from a ZIP archive central directory
which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
ClamScan --alert-exceeds-max command line option or ClamD AlertExceedsMax
config file option.
- Improved performance when scanning TNEF email attachments.
- Fixed an issue with recording metadata for OOXML office documents.
- Fixed an issue with signature matches for VBA in OLE2 office documents.
- Loosened overly restrictive rules for embedded file identification and
increased the limit for finding PE files embedded in other PE files.
- Fixed an issue with extracting some RAR archives embedded in other files.
- Fixed an issue with calculating fuzzy hashes affecting some images by updating
the version for several Rust library dependencies.
- This release does not require a newer version of the Rust compiler toolchain
than what was required for ClamAV 1.5.0.
GitHub pull request

ClamAV 1.5.0 includes the following improvements and changes:
Major changes
- Added checks to determine if an OLE2-based Microsoft Office document is
encrypted.
GitHub pull request
- Added the ability to record URIs found in HTML if the generate-JSON-metadata
feature is enabled.
Also adds an option to disable this in case you want the JSON metadata
feature but do not want to record HTML URIs.
The ClamScan command-line option is --json-store-html-uris=no.
The clamd.conf config option is JsonStoreHTMLURIs no.
The libclamav general scan option is CL_SCAN_GENERAL_STORE_HTML_URIS
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
- Added the ability to record URIs found in PDFs if the generate-JSON-metadata
feature is enabled.
Also adds an option to disable this in case you want the JSON metadata
feature but do not want to record PDF URIs.
The ClamScan command-line option is --json-store-pdf-uris=no.
The clamd.conf config option is JsonStorePDFURIs no.
The libclamav general scan option is CL_SCAN_GENERAL_STORE_PDF_URIS
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
GitHub pull request #4
- Added regex support for the clamd.conf OnAccessExcludePath config option.
This change courtesy of GitHub user b1tg.
GitHub pull request
- Added CVD signing/verification with external .sign files.
Freshclam will now attempt to download external signature files to accompany
existing .cvd databases and .cdiff patch files. Sigtool now has commands
to sign and verify using the external signatures.
ClamAV now installs a 'certs' directory in the app config directory
(e.g., <prefix>/etc/certs). The install path is configurable.
The CMake option to configure the CVD certs directory is
-D CVD_CERTS_DIRECTORY=PATH
New options to set an alternative CVD certs directory:
- The command-line option for Freshclam, ClamD, ClamScan, and Sigtool is
--cvdcertsdir PATH
- The environment variable for Freshclam, ClamD, ClamScan, and Sigtool is
CVD_CERTS_DIR
- The config option for Freshclam and ClamD is
CVDCertsDirectory PATH
Added two new APIs to the public clamav.h header:
cl_error_t cl_cvdverify_ex(
const char *file,
const char *certs_directory,
uint32_t dboptions);
cl_error_t cl_cvdunpack_ex(
const char *file,
const char *dir,
const char *certs_directory,
uint32_t dboptions);
The original cl_cvdverify and cl_cvdunpack are deprecated.
Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR.
You may set this option with cl_engine_set_str and get it with
cl_engine_get_str, to override the compiled in default CVD certs directory.
Thank you to Mark Carey at SAP for inspiring work on this feature with an
initial proof of concept for external-signature FIPS compliant CVD signing.
GitHub pull request #1
GitHub pull request #2
GitHub pull request #3
GitHub pull request #4
- Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable FIPS-like
limits disabling MD5 and SHA1 from being used for verifying digital signatures
or for being used to trust a file when checking for false positives (FPs).
For freshclam.conf and clamd.conf set this config option:
FIPSCryptoHashLimits yes
For clamscan and sigtool use this command-line option:
--fips-limits
For libclamav: Enable FIPS-limits for a ClamAV engine like this:
cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1);
ClamAV will also attempt to detect if FIPS-mode is enabled. If so, it will
automatically enable the FIPS-limits feature.
This change mitigates safety concerns over the use of MD5 and SHA1 algorithms
to trust files and is required to enable ClamAV to operate legitimately in
FIPS-mode enabled environments.
Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for detection
purposes or for informational purposes in FIPS-enabled environments and when
the FIPS-limits option is enabled.
GitHub pull request
- Upgraded the clean-file scan cache to use SHA2-256 (prior versions use MD5).
The clean-file cache algorithm is not configurable.
This change resolves safety concerns

ClamAV 1.3.1 is a critical patch release with the following fixes:- CVE-2024-20380:
Fixed a possible crash in the HTML file parser that could cause a
denial-of-service (DoS) condition.This issue affects version 1.3.0 only and does not affect prior versions.Thank you to Błażej Pawłowski for identifying this issue.
- GitHub pull request
- Updated select Rust dependencies to the latest versions.
This resolved Cargo audit complaints and included PNG parser bug fixes.
- GitHub pull request
- Fixed a bug causing some text to be truncated when converting from UTF-16.
- GitHub pull request
- Fixed assorted complaints identified by Coverity static analysis.
- GitHub pull request
- Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam
config option to be pruned and then re-downloaded with every update.
- GitHub pull request
- Added the new 'valhalla' database name to the list of optional databases in
preparation for future work.
- GitHub pull request
- Added symbols to the libclamav.map file to enable additional build
configurations.Patch courtesy of Neil Wilson.
- GitHub pull request

Major changes
- Added the ability to extract images embedded in HTML CSS <style> blocks.
- GitHub pull request: #813
- Updated to Sigtool so that the --vba option will extract VBA code from
- GitHub pull request: #852
- Added a new ClamScan and ClamD option: --fail-if-cvd-older-than=days.
- GitHub pull request: #867
- Added a new function cl_cvdgetage() to the libclamav API.
- GitHub pull request: #867
- Added a new function cl_engine_set_clcb_vba() to the libclamav API.
- GitHub pull request: #852
Other improvements
- Removed the vendored TomsFastMath library in favor of using OpenSSL to
- GitHub pull request: #840
- Build system:
Added CMake option DO_NOT_SET_RPATH to avoid setting
- GitHub pull request: #815
- Build system:
Enabled version-scripts with CMake to limit symbol exports for
- GitHub pull request: #776
- Build system:
Enabled users to pass in custom Rust compiler flags using the
- GitHub pull request: #835
- Removed a hard-coded alert for CVE-2004-0597.
- GitHub pull request: #855
- Set Git attributes to prevent Git from altering line endings for Rust
- GitHub pull request: #800
- Fixed compile time warnings.
- GitHub pull request: #795
- Added a minor optimization when matching domain name regex signatures for
- GitHub pull request: #837
- Build system:
Enabled the ability to select a specific Python version.
- GitHub pull request: #787
- Added improvements to the ClamOnAcc process log output so that it is
- GitHub pull request: #822
- Windows:
Enabled the MSI installer to upgrade between feature versions more
- GitHub pull request: #872
- Sigtool:
Added the ability to change the location of the temp directory
- GitHub pull request: #852
- Other minor improvements.
Bug fixes
- Fixed the broken ExcludePUA / --exclude-pua feature.
- GitHub pull request: #780
- Fixed an issue with integer endianness when parsing Windows executables on
- GitHub pull request: #814
- Fixed a possible stack overflow read when parsing WDB signatures.
- GitHub pull request: #807
- Fixed a possible index out of bounds when loading CRB signatures.
- GitHub pull request: #810
- Fixed a possible use after free when reading logical signatures.
- GitHub pull request: #811
- Fixed a possible heap overflow read when reading PDB signatures.
- GitHub pull request: #812
- Fixed a possible heap overflow read in javascript normalizer module.
- GitHub pull request: #868
- Fixed two bugs that would cause Freshclam to fail update when applying a
- GitHub pull request: #893
- Fixed an assortment of complaints identified by Coverity static analysis.
- GitHub pull requests:
- #891
- #899
- Fixed one of the Freshclam tests that was failing on some Fedora systems
- GitHub pull request: #881
- Correctly remove temporary files generated by the VBA and XLM extraction
- GitHub pull request: #894
- Arjen de Korte
- Craig Andrews
- Ged Haywood
- Matt Jolly
- Orion Poplawski
- Nicolas R.
- Răzvan Cojocaru
- Red
- Shawn Iverson
- Sebastian Andrzej Siewior
- The OSS-Fuzz project