ClamAV 1.5.0 Released with Enhanced MS Office and PDF File Verification

ClamAV 1.5.0 is now available with features aimed at strengthening malware detection in Microsoft Office and PDF documents, and it emphasises better handling of encrypted files and embedded links. The release adds improved checks for encrypted OLE2-based Office documents, enabling faster scans and clearer notifications when a file cannot be fully inspected, as reported by Cisco-Talos/clamav/releases.

It also expands metadata handling by recording URIs found in HTML and PDF files when the generate-JSON-metadata option is enabled, with command-line and config options to disable storing HTML or PDF URIs. A notable security enhancement is support for external .sign files to accompany CVD databases and patch files, with Freshclam downloading these signatures and Sigtool enabling signing and verification; a configurable certs directory is introduced for storing trusted certificates.

The update also implements FIPS-style limits to disable MD5 and SHA1 during signature verification, and upgrades the clean-file cache to SHA2-256. Additionally, ClamScan now reports exact bytes scanned in GiB, MiB, KiB or B, and new APIs in clamav.h give developers finer control over scanning and hashing.