ClamAV is an open source antivirus toolkit designed to detect viruses, trojans, malware, and other malicious threats. The project was originally created by Tomasz Kojm and is now maintained by Cisco Talos.
The software was first released in 2002 and is available under the GNU General Public License. It supports multiple operating systems including Linux, Windows, and macOS.
ClamAV is particularly known for its use in mail gateway scanning, where it scans email attachments for malware before they reach users.
Download ClamAV 1.5.4 - Software Mirrors |
|---|
Download ClamAV 1.5.4 for Windows |
Download ClamAV 1.5.4 for macOS |
Download ClamAV 1.5.4 for Linux |
ClamAV 1.5.4 Release Notes: ClamAV 1.5.4 is a patch release with the following fixes: - [CVE-2026-20337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20337): Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue. - [CVE-2026-20345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20345): Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue. - [CVE-2026-20339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20339): Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20338): Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20346): Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20347](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20347): Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20348](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20348): Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents. This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to leduckhuong for identifying this issue. - [CVE-2025-8088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8088): Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows. This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Yazdan Soltani for identifying that this issue affects ClamAV. - Fixed thread-safety issues in the `clamd` STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses. This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. - FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races. This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4. - Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. - Upgraded the Rust `crossbeam-epoch` dependency to resolve the RUSTSEC-2026-0204 advisory. |
Key Features of ClamAV
Open Source Antivirus Engine
ClamAV is completely open source, allowing organizations and developers to inspect the code, customize detection rules, and integrate it into security systems.
This transparency makes it popular in enterprise environments and Linux based infrastructures.
Command Line Scanner
ClamAV primarily operates through command line tools such as:
clamscan for manual file scanning
clamdscan for faster daemon based scanning
freshclam for updating virus definitions
These tools allow administrators to automate malware scanning across servers and systems.
Automatic Virus Database Updates
ClamAV regularly updates its malware signature database. The update utility downloads the latest virus definitions several times per day to keep detection up to date.
Frequent updates help maintain protection against new malware threats.
Archive and File Format Scanning
The engine supports scanning of many file formats and archives, including:
ZIP, RAR, TAR, GZIP
Microsoft Office files
PDF documents
HTML and RTF files
It can also unpack nested archives to detect malware hidden inside compressed files.
Email and Gateway Protection
One of ClamAV’s main use cases is scanning email attachments. It integrates with mail servers and filters to block infected files before they reach users.
Because of this capability, it has become a standard antivirus engine for many email gateways and hosting environments.
Performance and Usability
ClamAV is optimized for server environments where large volumes of files must be scanned quickly. Its architecture includes a multi threaded daemon that can process multiple scanning requests simultaneously.
Because the software is command line based, it may require technical knowledge to configure and operate effectively. Many administrators integrate it with scripts, web servers, or mail systems for automated scanning.
Graphical interfaces such as ClamTk exist but are developed by third parties.
Pros and Cons
Advantages
Completely open source and free
Strong integration with Linux servers
Frequently updated malware database
Supports many file formats and archives
Effective for email and server malware scanning
Limitations
Command line interface can be difficult for beginners
Detection rates may be lower than some commercial antivirus solutions in certain tests
Limited real time desktop protection compared to full endpoint security suites
ClamAV is often used as part of a broader security setup rather than as a standalone desktop antivirus.
Who Should Use ClamAV
ClamAV is best suited for:
Linux server administrators
Email server operators
Web hosting providers
Security professionals managing file uploads
Organizations needing open source antivirus solutions
It is commonly used in hosting environments, web servers, and email filtering systems.
Final Verdict
ClamAV is a powerful open source antivirus engine widely used for server side malware detection and email security. With a regularly updated signature database, support for many file formats, and strong integration capabilities, it remains a reliable tool for protecting systems from malware.
While it may not replace full desktop antivirus software, ClamAV continues to be an essential security component for many Linux servers and enterprise infrastructures.
ClamAV is one of the most widely used open source antivirus engines, especially in server environments and email security systems. It is commonly used on Linux servers, mail gateways, and file servers to detect malware and other malicious threats.
Developer:
ClamAV Team
Operating System:
Windows / macOS / Linux
Date Added:
2026-08-08T07:02:08.999Z
Categories:
Post a Comment/Report Broken Link: