The issues are fixed upstream in 0.99.4.
Mageia 5 and Mageia 6 are also affected.
Clamav has been updated to fix 2 security issues and also contains a lot of bugfixes.
Installed the packages before updating and also installed clamtk, the gui frontend.
This reported that the database needed to be updated.
Selected 'file' and pointed clamav at poc.
Scanned and reported "no threats found".  ??
Either the file was not properly decoded or it needs to be tested in a different way.
Note that the upstream analysis depended on ASAN.
Scanned user Downloads directory - 735 files - no threats found.
Checked the poc as well and as expected - no threats found.
Test ok. Could be pushed on core/updates ?
It already was over two months ago.
clamtk comes from its own SRPM.  It's not a part of this package.  The clamtk in updates_testing is for Bug 14505.
No, that's automatically generated because Len mentioned it in comment 3.