ClamAV 1.5.4 Open-Source Antivirus Fixes Eight Security Vulnerabilities

Version 1.5.4 introduces security patches for eight distinct vulnerabilities spread across the engine's ZIP, PDF, Mach-O, XAR, PE and UnRAR processing paths. Each flaw involved either a heap or stack overrun, integer underflow/overflow, or undefined behavior that could cause crashes or arbitrary memory writes when scanning crafted files. By correcting the parsing logic and size checks, the scanner no longer executes unsafe memory operations on malicious payloads.

Beyond the parser fixes, the update addresses concurrency problems in the clamd daemon's STATS command, which previously could leak memory contents or abort the service under simultaneous scan and status requests. The patch also tightens handling of large STATS responses to avoid partial socket writes that could otherwise truncate data. These changes improve daemon stability and reduce the attack surface for remote exploitation via the management interface.

FreeBSD users receive a specific race-condition fix that secures the move or removal of quarantined files, preventing an attacker from swapping the source path during the operation. The bundled UnRAR library is refreshed with an upstream patch, closing a long-standing vulnerability in archive extraction. Additionally, the Rust crossbeam-epoch crate is upgraded to satisfy a known advisory, ensuring the build chain remains free of known Rust-related issues.

Adopting the new release is straightforward: download the 1.5.4 binaries or pull the updated Alpine/Debian Docker images, replace the existing installation, and restart the clamd service. The older 1.4.6 branch is also updated, but it only incorporates six of the eight CVE fixes and retains the two missing parser patches, making it a less secure fallback for environments that cannot move to the newer branch. No configuration changes are required, but operators should verify that any custom plugins or integrations continue to load against the refreshed libraries.

The primary limitation is that any system still running a pre-1.5.4 version remains exposed to all eight vulnerabilities, and the 1.4.6 branch does not protect against the two newly disclosed parser bugs. Organizations must therefore plan to migrate to 1.5.4 or later to achieve full remediation. No functional regressions are reported, but testing in a staging environment is advisable to confirm that the updated Rust dependency does not affect any custom build pipelines.