Attributed metadata history
Up to 100 retained publisher events per page for c61b872a548f848cb44ad69137a15c1dd70054affef8a54ecb57cf3244e8fa9b. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_38fc32838f99f6297c
observed · 2026-10-12 08:49:03 UTC
Today, we are publishing the 1.4.3 and 1.0.9 security patch versions. We have also added Linux aarch64 (aka ARM64) RPM and DEB installer packages for the 1.4 LTS release.The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version.1.4.3ClamAV 1.4.3 is a patch release with the following fixes: CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.This issue only affects configurations where both:The max file-size scan limit is set greater than or equal to 1024MB.The max scan-size scan limit is set greater than or equal to 1025MB.The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.This issue affects all currently supported versions. It will be fixed in:1.4.31.0.9Thank you to Greg Walkup at Sandia National Labs for identifying this issu
Fingerprint: 8e7f873d6896256c903189d4924b9e7f4ad0d0498731244e089e1f9a735f19e9
intelligence_src_38fc32838f99f6297c
observed · 2026-10-12 08:49:03 UTC
available
Fingerprint: 83d3a1434f663ecad3039f78055a1e829c2f94ad3cb8d7994a2093239a836b4a