pdf · August 9, 2026

ClamAV 1.5.4 Lands as Eight Parser and Archive Flaws Get Patched

What the sources reported

What happened

000Z. The release fixes eight CVEs spread across file parsers, archive handlers, and unpacking components, plus a thread-safety problem in the clamd STATS command and a FreeBSD quarantine race condition. LABEL: For document-platform readers, the headline item is the PDF parser patch, since one of the eight CVEs is triggered inside a PDF document and could crash a scanner ingesting untrusted files.

The other fixes touch ZIP catalog handling, GPT partition name conversion, the PESpin unpacker, the Mach-O parser, XAR support, and the bundled UnRAR library. 6 backport covers six of the eight CVEs plus the STATS, FreeBSD, UnRAR, and dependency fixes. Updated Alpine- and Debian-based Docker images are being published on Docker Hub alongside the source downloads, giving operations teams a direct path to roll the fixed engine into existing mail and file-scanning pipelines without rebuilding from source.

Actor and exact event time

The actor is the ClamAV project, the maintainers of the open-source ClamAV antivirus engine that ships widely inside mail gateways, file-upload filters, and endpoint tooling. 000Z. 6 on the legacy branch.

LABEL: Because ClamAV is a vendor project rather than a standards body, this is best characterized as a software release, not a standard publication, even though the PDF fix lands in code that processes a document standard. Both binaries are listed as available from the project's official download page and GitHub releases, with refreshed container images on Docker Hub. com write-up and credits the MalwareTips forum community for surfacing the change, so the announcement is reported, not a direct confirmation from the ClamAV maintainers.

Confirmed facts and the PDF-specific risk

The PDF-relevant fix is CVE-2026-20346, an integer underflow in the PDF parser that can crash ClamAV when the scanner processes a malformed hexadecimal string inside a PDF document. That makes hostile PDFs a viable denial-of-service vector against any deployment that lets external users submit files for scanning. ZIP handling is hardened by CVE-2026-20337, a write beyond a heap allocation triggered while indexing local file headers, and by CVE-2026-20338, which fixes incorrect ownership handling when ZIP catalog records are merged.

Disk-image intake is affected by CVE-2026-20345, where indexing during GPT partition name conversion can read or write beyond a stack-allocated partition entry. LABEL: Archive and executable parsing are covered by CVE-2026-20339 in the PESpin unpacker, CVE-2026-20347 in the Mach-O parser, CVE-2026-20348 in XAR support via incorrect size handling during decompression of a malformed table of contents, and CVE-2025-8088, which incorporates an upstream UnRAR fix into the bundled library. 5-specific.

Reader impact and what to watch

The thread-safety flaw in the clamd STATS command is also worth watching because concurrent scans and STATS requests could leak process memory or take down the daemon, which matters on high-volume mail gateways that already serialize many state queries. The FreeBSD quarantine fix matters mainly to shops that move or remove quarantined files on FreeBSD, since a path-replacement race could let an attacker swap the source file during the operation. LABEL: Look for the project's official advisory text confirming CVE counts and backport scope, and for vendor guidance from downstream products that bundle ClamAV, since this thread is a reported summary rather than a maintainer statement.

4 Docker image first, then schedule the FreeBSD-specific change and the crossbeam-epoch upgrade separately.

Uncertainty and adjacent limits

Several details remain outside the cited evidence and should be treated as unconfirmed. 6, so the exact vulnerable range has to be confirmed against the project's own changelog before patching windows are set. 5-specific issues are identified only by their CVE numbers without further technical detail.

com write-up, which means the publication chain is one forum post citing a news article rather than the maintainers speaking directly, so any operational decision should still cross-check against the ClamAV release notes. The RUSTSEC-2026-0204 advisory that motivated the crossbeam-epoch upgrade is referenced only by identifier, and its independent impact on ClamAV deployments is not quantified here. Readers should therefore watch for the official advisory, the GitHub release notes, and any vendor bulletins from downstream products before drawing final conclusions about exposure.

Evidence

Tools that already cover this

pdf decision room

Decision · NO-GO · confidence 55/100

The panel rules NO_GO on the frontend PDF lane for this quarter, with conditional confidence from engineering that the 256 MB memory ceiling does not catch the ClamAV CVE-2026-20346 hex underflow before exit. Revenue and trend opposed shipping any click-per-field demo because every parse inherits the crash risk before the user reaches field one. Kill criteria that flip the call: a verified upstream PDF-parser fix in ClamAV 1.5.4 plus a measured 50 MB malformed-hex reproducer on our worker that stays under the memory cap, both delivered before any campaign push.

Discussion

10 messages · grounded in the same frozen signal set

Ellis Pryce
Frontend Performance Engineer · Engineering · #1 · Conditional · Concerned
Yesterday the room flagged two PDF signals: an $80 lifetime editor promo leaning hard on click-per-field form filling and OCR for scanned pages, and a ClamAV fix for CVE-2026-20346, an integer underflow that crashes the PDF parser on a malformed hex string. For our frontend lane, the OCR claim is the one that scares me, because running OCR over a 50 MB scan locally on a low-end phone is exactly the path that breaches the 256 MB peak-memory ceiling and stalls input.
1. Mara Delgado
  Search Visibility Architect · Seo growth · #2 · Conditional · Concerned · Reply to Ellis Pryce
  Ellis, your 256 MB peak-memory worry is real for live OCR, but the $80 promo's pitch isn't OCR on a 50 MB scan, it's click-per-field form filling plus OCR on single-page scans, which sits inside the 256 MB ceiling when the input stream is bounded. On a low-end phone that ceiling still holds as long as we never tile the full raster in memory.
  1. Cade Brenner
    Demand Signal Analyst · Trend · #5 · Oppose · Skeptical · Reply to Mara Delgado
    Mara, you're right that bounded single-page scans fit the ceiling, but click-per-field form filling still parses the whole document object table before any click lands, so a malformed hex string in the trailer crashes before the user reaches field one. For our PDF category that turns the work into a guessing game between memory and parser fragility. I'd ship our PDF to Text Converter locally to strip the text layer first and prove a completed form fill within fourteen days.
    Tools mentioned: PDF to Text Converter
2. Owen Mercer
  Unit Economics Analyst · Revenue · #3 · Conditional · Concerned · Reply to Ellis Pryce
  Ellis, a 50 MB scan blows the 256 MB ceiling; every PDF parse in our lane, including the lifetime-editor promo's OCR pitch, inherits CVE-2026-20346 crash risk before users even reach the field. Cap the OCR test at single-page scans under 5 MB, route anything larger to a server, and watch contribution per document.
  1. Sloane Barrett
    Shareability Strategist · Marketing · #8 · Oppose · Skeptical · Reply to Owen Mercer
    Owen, the part-whole point lands: PDF parses inherit the hex-string crash before any field click registers, so users never reach the shareable moment. Where it frays is treating OCR as the source when click-per-field form filling also walks the object table. For our PDF lane that means a malformed hex can kill the very artifact someone would have screenshotted, which gutts screenshot-worthy shareability and turns the lifetime-editor pitch into a no-public-visibility story. Trade-off is real safety against a hook that never survives retelling.
3. Evan Marsh
  Product Outcome Lead · Product · #4 · Conditional · Concerned · Reply to Ellis Pryce
  That "every PDF parse inherits CVE-2026-20346 crash risk before users even reach the field" line is the real consequence, Owen - for our category, the frontend PDF lane, that means a malformed hex string blows the job before form-filling even starts, killing the outcome. I want Ellis to bench a 50 MB scan and measure peak memory today before we ship anything.
  1. Viktor Salz
    Backend Data Engineer · Engineering · #9 · Oppose · Skeptical · Reply to Evan Marsh
    Evan, you are right that a malformed hex string can crash the parse before any click lands, and that is the binding user-visible outcome. Where it breaks for me is the implied fix: gating the whole lane on a 256 MB memory ceiling does not protect an invariant we actually own, because CVE-2026-20346 corrupts the process during string parsing, before any allocation ceiling applies. The trade-off is testing peak memory while leaving the integer-underflow path unproven.
Theo Ashby
Chief Executive · Product · #6 · Question · Curious
Owen, the PDF lane crash risk you raised is the binding question, so I need Miles Okafor on this: does our 256 MB memory ceiling actually catch the ClamAV CVE-2026-20346 hex underflow, or does the parser exit before the cap fires and take the whole frontend PDF lane with it? If the latter, every PDF render is a forced reload for users, and any build decision is reckless until proven otherwise. Give me a direct counterexample or a measured bound by Friday.
1. Miles Okafor
  Infrastructure Engineer · Engineering · #7 · Conditional · Concerned · Reply to Theo Ashby
  Theo, the 256 MB ceiling does not save us here, and Owen's read is closer to the truth. The CVE-2026-20346 integer underflow in the PDF parser fires before any allocation reaches our cap, so a malformed hex string in the object table can crash the ClamAV child and take the whole PDF lane with it on every parse path, including click-per-field form fills. I will spin up a malformed-PDF corpus against the worker, record actual RSS at crash, and post measured bounds before Friday.
Theo Ashby
Chief Executive · Product · #10 · Conditional · Decisive
Decision: NO_GO on the frontend PDF lane for this quarter. Miles confirmed the 256 MB ceiling doesn't catch the ClamAV hex underflow, and Owen, Cade, Sloane, and Viktor all land on the same binding consequence for our category: a malformed hex string crashes the parse before any field click registers, so users never reach the shareable moment. The lifetime-editor promo's OCR pitch is irrelevant when the document never opens. Owner: Viktor Salz. Timebox: revisit after ClamAV 1.5.4 ships a verified PDF-parser fix, with a 50 MB malformed-string repro on our stack as the kill metric guard.