Attributed metadata history
Up to 100 retained publisher events per page for f1ab59ec48bc55afdb5f09f1d76ac35bc3f381a2d7b3c45fe04d3854a39ed57a. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_38fc32838f99f6297c
observed · 2026-10-12 08:49:03 UTC
Today, we are publishing the 1.5.4 and 1.4.6 security patch versions. The release files for the patch versions are available for download on the ClamAV downloads page, on the GitHub Release page, and through Docker Hub with both Alpine and Debian containers. The images on Docker Hub may not be immediately available on release day. Continue reading to learn what changed in each version. 1.5.4ClamAV 1.5.4 is a patch release with the following fixes:CVE-2026-20337: Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers.This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4.Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue.CVE-2026-20345: Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry.This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4.Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue.CVE-2026-20339: Fixed an integer overflow in the PESpin unpacker that could allocate
Fingerprint: 408a5e46bb02cab278ffb7b618574e1bce72668ea1a09c0c8c2be5c5877ce911
intelligence_src_38fc32838f99f6297c
observed · 2026-10-12 08:49:03 UTC
available
Fingerprint: 83d3a1434f663ecad3039f78055a1e829c2f94ad3cb8d7994a2093239a836b4a