ClamAV 1.4.3 is a patch release with the following fixes:

• CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution.

  This issue only affects configurations where both:

  1. The max file-size scan limit is set greater than or equal to 1024MB.
  2. The max scan-size scan limit is set greater than or equal to 1025MB.

  The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug.

  This issue affects all currently supported versions. It will be fixed in:

  • 1.4.3
  • 1.0.9

  Thank you to Greg Walkup at Sandia National Labs for identifying this issue.

• : Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition.