We run clamav on all our user-uploaded files. It's currently giving this message for several PDFs:

<filename...>: Pdf.Exploit.CVE_2014_8449 FOUND

Looking at the CVE, it's for a integer overflow in Acrobat. So what does it mean that a PDF matches a signature definition for it? Has ClamAV detect actual code that would run as a result of the overflow, or could this be a false positive? How would I tell?

If there is indeed malicious code in these PDFs, we'd like to stop serving them and inform the users. But it would be nice to know if these are just a bunch of false positives.

  • Looks like security.stackexchange.com/questions/78634/… attracted more attention. One or the other will have to be closed as a duplicate. Commented Jan 7, 2015 at 21:14
  • Huh. I wonder why that one got so many more responses.
    – morganwahl
    Commented Jan 8, 2015 at 18:34
  • Randomness that got the other one over the Hot Questions threshold, I presume. Commented Jan 8, 2015 at 18:37

1 Answer 1


If the files are not sensitive from a content point of view you can upload them to a checker such as Virus Total

If this also gives you a positive result it's likely an infection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .