ClamAV has released security patch versions 1.5.4 and 1.4.6 to address CVE-2026-20337. This vulnerability involves a ZIP catalogue capacity tracking issue that could lead to a heap write-beyond-bounds while indexing local file headers. Users are advised to update their ClamAV installations to these patched versions to mitigate the risk.