Comment 1 for bug 1952449

You are right Artyom and the ubunt-security Team also somewhat regularly backports clamav.
That is how focal started with
  0.102.2+dfsg-2ubuntu1
and nowadays has
  0.103.2+dfsg-0ubuntu0.20.04.2

Assigning to ubuntu-security as they usually deal with this.