Skip to content
SPECIFICTION
Get listed

ClamAV

clamav.net

Free plan Open source WindowsmacOSLinuxAPISelf-hosted
Visit clamav.net
Spec score 8.9 #4 of 43 in Antivirus for Mac

What it is

ClamAV is a free, open-source antivirus engine for email and web scanning and endpoint security tasks. It provides a multi-threaded daemon, a command-line scanner and a tool for automated virus database updates. The database receives updates multiple times per day, and the updater supports scripted updates and digital signatures. ClamAV scans standard mail formats and many archive, executable and document formats, including MS Office, HTML, RTF and PDF. A Milter interface supports Sendmail. On modern Linux versions, ClamOnAcc can scan files when accessed, with an option to block access until scanning finishes. Signed signature databases limit execution to trusted definitions. The project lists GNU/Linux, FreeBSD, macOS and Windows as regularly tested platforms, and official Docker images are available for Alpine Linux and Debian Linux. ClamAV is an engine and associated tools, not a traditional antivirus or endpoint security suite. Recommended minimum resources are 3 GiB RAM, a 2.0 GHz CPU and 5 GiB of free disk space. The project does not guarantee extraction of every version or variant of supported formats.

Spec sheet

What it does
ClamAV is an open-source antivirus engine for detecting viruses, trojans, malware and related threats.Read 15 Oct 2026 · clamav.net
Purpose
ClamAV is an open-source antivirus engine used for email and web scanning and endpoint security.Read 7 Oct 2026 · clamav.net
Free plan
YesRead 20 Sep 2026 · clamav.net
License
ClamAV is licensed under the GNU General Public License version 2.Read 15 Oct 2026 · docs.clamav.net
API and library
The core engine is available as a shared library, and applications can use clamd through its socket protocol.Read 15 Oct 2026 · docs.clamav.net
Archive support
Built-in extraction covers formats including ZIP, RAR, 7-Zip, ARJ, TAR, gzip, bzip2, DMG, ISO, OLE2, OOXML, Cabinet and CHM.Read 15 Oct 2026 · docs.clamav.net
Automatic updates
FreshClam periodically downloads new virus databases and verifies signed updates.Read 15 Oct 2026 · docs.clamav.net
Bytecode engine
Its bytecode runtime lets signature authors distribute complex detection routines that execute inside the scanner.Read 15 Oct 2026 · docs.clamav.net
Command-line scanner
ClamAV includes the clamscan command-line utility for on-demand file scanning.Read 15 Oct 2026 · clamav.net
Company founded
LinkedIn lists Cisco as founded in 1984.Read 15 Oct 2026 · linkedin.com
Company funding record
Crunchbase lists Sequoia Capital as a Cisco investor and shows one funding round, while concealing the amount.Read 15 Oct 2026 · crunchbase.com
Company headquarters
Cisco is headquartered in San Jose, California, United States.Read 15 Oct 2026 · linkedin.com
Company legal name
Crunchbase lists the maker's legal name as Cisco Systems, Inc.Read 15 Oct 2026 · crunchbase.com
Company size
LinkedIn lists Cisco's company size as 10,001 or more employees.Read 15 Oct 2026 · linkedin.com
Current release
The stable release listed in 2026 is version 1.5.4, released on 7 August 2026.Read 15 Oct 2026 · en.wikipedia.org
Database cadence
The official virus database is normally updated once or twice daily.Read 15 Oct 2026 · docs.clamav.net
Deployment options
Official Docker images are available for Alpine Linux and Debian Linux.Read 7 Oct 2026 · docs.clamav.net
Document support
The engine parses formats such as Microsoft Office, HTML, RTF, PDF, OneNote and HWP.Read 15 Oct 2026 · docs.clamav.net
Documentation depth
The documentation includes usage diagrams, installation procedures, configuration guidance, signature writing, FAQs and on-access recipes.Read 15 Oct 2026 · docs.clamav.net
Download verification
ClamAV release packages from its downloads page can be verified using GnuPG and the Cisco Talos public key.Read 7 Oct 2026 · docs.clamav.net
Executable support
ClamAV parses 32-bit and 64-bit PE files plus ELF and Mach-O binaries, including several packed formats.Read 15 Oct 2026 · docs.clamav.net
Extensibility
Administrators can add custom signature files and use supported YARA rules alongside the standard databases.Read 15 Oct 2026 · freebsdsoftware.org
File coverage
It supports standard mail formats, many archive formats, executable formats, and popular document formats including MS Office, HTML, RTF, and PDF.Read 7 Oct 2026 · clamav.net
Format limitation
The project does not guarantee it can unpack or extract every version or variant of supported formats.Read 7 Oct 2026 · docs.clamav.net
Installation choices
Official instructions cover package managers, Linux DEB/RPM packages, macOS PKG, Windows installer or portable ZIP, Docker images and source builds.Read 15 Oct 2026 · docs.clamav.net
Limit: detection coverage
Independent testing summarized by Wikipedia reported 59.94% overall detection in a 2022 commodity-malware study, with weaker results for several file types and malware categories.Read 15 Oct 2026 · en.wikipedia.org
Limit: endpoint scope
Independent analysis says ClamAV is a signature engine rather than a full desktop endpoint suite, with no default real-time protection, cloud reputation, behavioral blocking or sandbox.Read 15 Oct 2026 · scan.now
Limit: platform-specific real time
FreeBSD reviewers state that native on-access scanning is unavailable on FreeBSD because the required fanotify-equivalent interface is absent.Read 15 Oct 2026 · freebsdsoftware.org
Linux real-time scanning
ClamOnAcc provides on-access scanning and optional access blocking on Linux systems.Read 15 Oct 2026 · docs.clamav.net
Mail integration
The product provides a milter interface for Sendmail and supports common mail-file formats.Read 15 Oct 2026 · clamav.net
Maker relationship
The documentation identifies Cisco Systems, Inc. as the organization bringing ClamAV to users.Read 15 Oct 2026 · docs.clamav.net
Not an endpoint suite
The documentation says ClamAV is not a traditional antivirus or endpoint security suite.Read 7 Oct 2026 · docs.clamav.net
Notable security news
Wikipedia records two 2026 security releases fixing bugs, including issues dating back as far as 2004.Read 15 Oct 2026 · en.wikipedia.org
Official Docker images
Cisco publishes clamav/clamav Alpine and clamav/clamav-debian images with versioned, stable and unstable tags.Read 15 Oct 2026 · docs.clamav.net
On-access requirements
Linux on-access scanning requires kernel 3.8 or newer and curl 7.45 or newer.Read 15 Oct 2026 · docs.clamav.net
On-access scanning
ClamOnAcc provides on-access scanning on modern Linux versions, with an optional ability to block file access until scanning completes.Read 7 Oct 2026 · docs.clamav.net
Praise: openness and integration
Independent coverage highlights its free GPL model, scriptability, embeddable daemon and broad ecosystem integrations.Read 15 Oct 2026 · scan.now
Praise: server and mail use
Independent reviewers repeatedly describe ClamAV as a practical choice for mail gateways, file-upload services, Samba shares and servers passing files to other machines.Read 15 Oct 2026 · bigiron.cc
Primary use
The project is designed especially for scanning email at mail gateways.Read 15 Oct 2026 · docs.clamav.net
Protection scope
antivirusRead 20 Sep 2026 · clamav.net
Rating on FreeBSD Software
7 out of 10 from 1 editorial review.Read 15 Oct 2026 · freebsdsoftware.org
Rating on Microsoft Marketplace
5.0 out of 5 from 1 rating for an ATH Infosystems ClamAV listing.Read 15 Oct 2026 · marketplace.microsoft.com
Scanning daemon
The clamd service is a scalable multithreaded daemon that keeps signatures loaded for repeated scans.Read 15 Oct 2026 · docs.clamav.net
Scanning tools
It provides a multi-threaded daemon, a command-line scanner, and a tool for automatic database updates.Read 7 Oct 2026 · clamav.net
Security reporting
Malware and false-positive submissions are handled by Cisco Talos; uploaded samples are retained indefinitely and are not shared outside Cisco unless already obtained elsewhere.Read 15 Oct 2026 · docs.clamav.net
Signature trust
Signed signature databases ensure that ClamAV executes only trusted signature definitions.Read 7 Oct 2026 · docs.clamav.net
Signature updates
Its virus database is updated multiple times per day, and the updater supports scripted updates and digital signatures.Read 7 Oct 2026 · clamav.net
Signed definitions
Digitally signed signature databases are used so the engine executes trusted definitions.Read 15 Oct 2026 · docs.clamav.net
Support channels
Project support is provided through moderated announcement and virus-database lists, user and developer mailing lists, Discord and GitHub issues.Read 15 Oct 2026 · docs.clamav.net
Supported operating systems
Regularly tested systems include current LTS releases of Alpine, Ubuntu, Debian, AlmaLinux, Fedora, openSUSE, FreeBSD, macOS and Windows.Read 15 Oct 2026 · docs.clamav.net
Supported platforms
GNU/Linux,FreeBSD,macOS,WindowsRead 20 Sep 2026 · clamav.net
System CPU and disk
The stated minimum recommendation is one 2.0 GHz CPU and 5 GiB of free disk space.Read 15 Oct 2026 · docs.clamav.net
System memory
The project recommends at least 3 GiB of RAM for ClamScan or ClamD with the standard signature database.Read 15 Oct 2026 · docs.clamav.net
System requirements
The recommended minimum is 3 GiB of RAM, a 2.0 GHz CPU, and 5 GiB of free disk space.Read 7 Oct 2026 · docs.clamav.net

Plans and prices

ClamAV Free Open-source anti-virus engine under GPL; no paid plan or price stated Read 7 Oct 2026 · clamav.net
ClamAV open-source software Free free of charge GPL-2.0 software · self-hosted Read 15 Oct 2026 · en.wikipedia.org

Every ClamAV plan and price →

Strong points and limits

Strong points

  • Virus database updates arrive multiple times per day.
  • Supports mail, archive, executable and document formats.
  • ClamOnAcc offers on-access scanning on modern Linux.
  • Free and open-source under GPL.

Limits

  • Not a traditional antivirus or endpoint security suite.
  • Requires 3 GiB RAM, 2.0 GHz CPU and 5 GiB disk.
  • Does not guarantee extraction of every supported format variant.

Who it suits

ClamAV suits users seeking an open-source scanning engine and tools for email, web content or Linux on-access scanning. It may suit users prepared to deploy and manage an engine rather than a traditional endpoint security suite.

Verdict

ClamAV provides a broad set of scanning tools and regularly updated signatures across several listed operating systems. Readers should account for its stated system requirements and its distinction from a full endpoint suite.

Where Specifiction places it

Alternatives to ClamAVAll alternatives →