CGA-hrr4-xgmj-8m9r

1.3 is EOL upstream (expected support periods are documented at https://docs.clamav.net/faq/faq-eol.html#version-support-matrix). As per https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html users should upgrade to clamav-1.4 to receive the fix.

Upstream have introduced a fix in version 1.4.3 and 1.0.9. However, they are still working on introducing the fix into the main and other supported branches. It's expected that this CVE will be fixed once version 1.3.3 is tagged and released