Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
17 vulnerabilities
CVE-2026-12068 (GCVE-0-2026-12068)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:19 – Updated: 2026-06-12 22:19
VLAI
Title
Avira Password Manager credential disclosure via cross-origin autofill in Firefox
Summary
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.
This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
Severity
7.4 (High)
CWE
- CWE-669 - Incorrect Resource Transfer Between Contexts
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Password Manager |
Affected:
*
|
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Firefox",
"Windows",
"macOS",
"Linux"
],
"product": "Avira Password Manager",
"vendor": "Gen Digital",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Riccardo, an independent security researcher at TU Wien"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\u003cp\u003eThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.\u003c/p\u003e"
}
],
"value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux."
}
],
"impacts": [
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116 Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-669",
"description": "CWE-669 Incorrect Resource Transfer Between Contexts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:19:18.986Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. \u003cstrong\u003eNo software update is currently planned.\u003c/strong\u003e"
}
],
"value": "Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. No software update is currently planned."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira Password Manager credential disclosure via cross-origin autofill in Firefox",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2026-12068",
"datePublished": "2026-06-12T22:19:18.986Z",
"dateReserved": "2026-06-12T09:09:57.930Z",
"dateUpdated": "2026-06-12T22:19:18.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6676 (GCVE-0-2026-6676)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:16 – Updated: 2026-06-12 22:16
VLAI
Title
Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive
Summary
Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.
Severity
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.27.12
(custom)
|
Date Public
2026-02-26 11:42
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.27.12",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2026-02-26T11:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:16:27.745Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.27.12\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.27.12 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.27.12 or any later engine release. Builds at or above 8.3.27.12 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2026-6676",
"datePublished": "2026-06-12T22:16:27.745Z",
"dateReserved": "2026-04-20T14:46:06.355Z",
"dateUpdated": "2026-06-12T22:16:27.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14098 (GCVE-0-2025-14098)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:16 – Updated: 2026-06-12 22:16
VLAI
Title
Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file
Summary
Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.
Severity
7.8 (High)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.104
(custom)
|
Date Public
2025-12-05 12:20
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.104",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-12-05T12:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:16:01.317Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.104\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.104 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.104 or any later engine release. Builds at or above 8.3.70.104 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB write when scanning a malformed MS-DOS executable file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-14098",
"datePublished": "2026-06-12T22:16:01.317Z",
"dateReserved": "2025-12-05T10:54:10.986Z",
"dateUpdated": "2026-06-12T22:16:01.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9033 (GCVE-0-2025-9033)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:15 – Updated: 2026-06-12 22:15
VLAI
Title
Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3)
Summary
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.76
(custom)
|
Date Public
2025-08-15 14:33
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.76",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-08-15T14:33:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:15:25.006Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.76\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.76 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.76 or any later engine release. Builds at or above 8.3.70.76 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 3)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-9033",
"datePublished": "2026-06-12T22:15:25.006Z",
"dateReserved": "2025-08-14T11:15:45.781Z",
"dateUpdated": "2026-06-12T22:15:25.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9032 (GCVE-0-2025-9032)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:14 – Updated: 2026-06-12 22:14
VLAI
Title
Avira antivirus engine heap buffer OOB read when scanning a malformed PE file
Summary
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.98
(custom)
|
Date Public
2025-08-14 11:32
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.98",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-08-14T11:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:14:51.060Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.98\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.98 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.98 or any later engine release. Builds at or above 8.3.70.98 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB read when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-9032",
"datePublished": "2026-06-12T22:14:51.060Z",
"dateReserved": "2025-08-14T11:11:49.220Z",
"dateUpdated": "2026-06-12T22:14:51.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7019 (GCVE-0-2025-7019)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:14 – Updated: 2026-06-12 22:14
VLAI
Title
Avast antivirus stack overflow when scanning a malformed Office Open XML file
Summary
Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
5.5 (Medium)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25020100
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25020100
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25020100
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25020100
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25020100
(custom)
|
Date Public
2024-12-04 18:16
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25020100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25020100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25020100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25020100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25020100",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2024-12-04T18:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:14:19.144Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25020100\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25020100 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25020100 or any later virus-definition update. All builds at or above VPS 25020100 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus stack overflow when scanning a malformed Office Open XML file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7019",
"datePublished": "2026-06-12T22:14:19.144Z",
"dateReserved": "2025-07-02T12:03:39.699Z",
"dateUpdated": "2026-06-12T22:14:19.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7018 (GCVE-0-2025-7018)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:13 – Updated: 2026-06-12 22:13
VLAI
Title
Avira antivirus engine null pointer dereference when scanning a malformed PE file
Summary
Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.64.
Severity
5.5 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.64
(custom)
|
Date Public
2025-01-31 11:34
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-01-31T11:34:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.64.\u003c/p\u003e"
}
],
"value": "Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.64."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:13:49.820Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.64\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.64 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.64 or any later engine release. Builds at or above 8.3.70.64 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine null pointer dereference when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7018",
"datePublished": "2026-06-12T22:13:49.820Z",
"dateReserved": "2025-07-02T12:01:13.717Z",
"dateUpdated": "2026-06-12T22:13:49.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7017 (GCVE-0-2025-7017)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:13 – Updated: 2026-06-12 22:13
VLAI
Title
Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file
Summary
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.56
(custom)
|
Date Public
2025-01-17 15:40
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.56",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-01-17T15:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:13:13.533Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.56\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.56 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.56 or any later engine release. Builds at or above 8.3.70.56 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7017",
"datePublished": "2026-06-12T22:13:13.533Z",
"dateReserved": "2025-07-02T11:59:07.847Z",
"dateUpdated": "2026-06-12T22:13:13.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7011 (GCVE-0-2025-7011)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:12 – Updated: 2026-06-12 22:12
VLAI
Title
Avast antivirus heap OOB when scanning a malformed zip file
Summary
Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
25020100 , < 25021208
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
25020100 , < 25021208
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
25020100 , < 25021208
(custom)
|
|
| Gen Digital | Avast One |
Affected:
25020100 , < 25021208
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
25020100 , < 25021208
(custom)
|
Date Public
2025-05-26 11:28
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "25020100",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "25020100",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "25020100",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "25020100",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "25020100",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:12:37.444Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25021208\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25021208 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25021208 or any later virus-definition update. All builds at or above VPS 25021208 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus heap OOB when scanning a malformed zip file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7011",
"datePublished": "2026-06-12T22:12:37.444Z",
"dateReserved": "2025-07-02T08:27:37.717Z",
"dateUpdated": "2026-06-12T22:12:37.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7010 (GCVE-0-2025-7010)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:11 – Updated: 2026-06-12 22:11
VLAI
Title
Avast antivirus stack overflow when scanning a malformed PDF file
Summary
Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021208.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25021208
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25021208
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25021208
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25021208
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25021208
(custom)
|
Date Public
2025-05-26 11:28
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021208",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021208.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021208.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:11:22.855Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25021208\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25021208 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25021208 or any later virus-definition update. All builds at or above VPS 25021208 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus stack overflow when scanning a malformed PDF file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7010",
"datePublished": "2026-06-12T22:11:22.855Z",
"dateReserved": "2025-07-02T08:18:37.465Z",
"dateUpdated": "2026-06-12T22:11:22.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7009 (GCVE-0-2025-7009)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:10 – Updated: 2026-06-12 22:10
VLAI
Title
Avast antivirus heap buffer OOB read when scanning a malformed PE file
Summary
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25021310
(custom)
|
Date Public
2025-05-26 11:28
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:10:26.925Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25021310\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25021310 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25021310 or any later virus-definition update. All builds at or above VPS 25021310 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus heap buffer OOB read when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7009",
"datePublished": "2026-06-12T22:10:26.925Z",
"dateReserved": "2025-07-02T07:50:52.477Z",
"dateUpdated": "2026-06-12T22:10:26.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7008 (GCVE-0-2025-7008)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:09 – Updated: 2026-06-12 22:09
VLAI
Title
Avast antivirus heap buffer OOB read when scanning a malformed PE file
Summary
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25021310
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25021310
(custom)
|
Date Public
2025-05-26 11:28
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25021310",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:09:49.037Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25021310\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25021310 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25021310 or any later virus-definition update. All builds at or above VPS 25021310 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus heap buffer OOB read when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7008",
"datePublished": "2026-06-12T22:09:49.037Z",
"dateReserved": "2025-07-02T07:48:33.725Z",
"dateUpdated": "2026-06-12T22:09:49.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7006 (GCVE-0-2025-7006)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:08 – Updated: 2026-06-12 22:08
VLAI
Title
Avast antivirus use of stack memory after free when scanning a malformed PE file
Summary
Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25022500.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
5.5 (Medium)
CWE
- CWE-590 - Free of Memory not on the Heap
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25022500
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25022500
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25022500
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25022500
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25022500
(custom)
|
Date Public
2025-05-26 11:27
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25022500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25022500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25022500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25022500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25022500",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:27:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25022500.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25022500.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-590",
"description": "CWE-590 Free of Memory not on the Heap",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:08:57.786Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25022500\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25022500 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25022500 or any later virus-definition update. All builds at or above VPS 25022500 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus use of stack memory after free when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7006",
"datePublished": "2026-06-12T22:08:57.786Z",
"dateReserved": "2025-07-02T07:45:21.338Z",
"dateUpdated": "2026-06-12T22:08:57.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7005 (GCVE-0-2025-7005)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:07 – Updated: 2026-06-12 22:07
VLAI
Title
Avast antivirus infinite recursion when scanning a malformed PE file
Summary
Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25031700.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25031700
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25031700
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25031700
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25031700
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25031700
(custom)
|
Date Public
2025-05-26 11:27
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25031700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25031700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25031700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25031700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25031700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:27:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25031700.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25031700.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125 Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:07:35.906Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25031700\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25031700 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25031700 or any later virus-definition update. All builds at or above VPS 25031700 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus infinite recursion when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7005",
"datePublished": "2026-06-12T22:07:35.906Z",
"dateReserved": "2025-07-02T07:43:53.447Z",
"dateUpdated": "2026-06-12T22:07:35.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7004 (GCVE-0-2025-7004)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:04 – Updated: 2026-06-12 22:04
VLAI
Title
Avast antivirus heap buffer OOB write when scanning a malformed PE file
Summary
Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Severity
7.8 (High)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 25040308
(custom)
|
|
| Gen Digital | AVG Antivirus |
Affected:
0 , < 25040308
(custom)
|
|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 25040308
(custom)
|
|
| Gen Digital | Avast One |
Affected:
0 , < 25040308
(custom)
|
|
| Gen Digital | Avast Business Antivirus |
Affected:
0 , < 25040308
(custom)
|
Date Public
2025-05-26 11:01
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25040308",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "AVG Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25040308",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25040308",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast One",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25040308",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avast Business Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "25040308",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.\u003cp\u003eThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.\u003c/p\u003e\u003cp\u003eThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.\n\nThis issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.\n\n\n\nThe affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:04:48.483Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install virus definitions \u003cstrong\u003eVPS 25040308\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e virus-definition update. All builds at or above VPS 25040308 include the fix; staying current on definitions is required."
}
],
"value": "Install virus definitions VPS 25040308 or any later virus-definition update. All builds at or above VPS 25040308 include the fix; staying current on definitions is required."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast antivirus heap buffer OOB write when scanning a malformed PE file",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7004",
"datePublished": "2026-06-12T22:04:48.483Z",
"dateReserved": "2025-07-02T07:42:38.625Z",
"dateUpdated": "2026-06-12T22:04:48.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7003 (GCVE-0-2025-7003)
Vulnerability from cvelistv5 – Published: 2026-06-12 22:02 – Updated: 2026-06-12 22:02
VLAI
Title
Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1)
Summary
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.56
(custom)
|
Date Public
2025-06-13 09:30
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.56",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-06-13T09:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T22:02:30.484Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.56\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.56 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.56 or any later engine release. Builds at or above 8.3.70.56 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 1)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7003",
"datePublished": "2026-06-12T22:02:30.484Z",
"dateReserved": "2025-07-02T07:39:58.345Z",
"dateUpdated": "2026-06-12T22:02:30.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-7002 (GCVE-0-2025-7002)
Vulnerability from cvelistv5 – Published: 2026-06-12 21:59 – Updated: 2026-06-12 21:59
VLAI
Title
Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2)
Summary
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.
Severity
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avira Antivirus |
Affected:
0 , < 8.3.70.68
(custom)
|
Date Public
2025-05-26 11:28
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows",
"macOS",
"Linux"
],
"product": "Avira Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "8.3.70.68",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mike Zhang, an independent security researcher"
}
],
"datePublic": "2025-05-26T11:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\u003cp\u003eThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.\u003c/p\u003e"
}
],
"value": "Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.\n\nThis issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68."
}
],
"impacts": [
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T21:59:52.538Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Avira scan engine build \u003cstrong\u003e8.3.70.68\u003c/strong\u003e or \u003cstrong\u003eany later\u003c/strong\u003e engine release. Builds at or above 8.3.70.68 include the fix."
}
],
"value": "Upgrade to Avira scan engine build 8.3.70.68 or any later engine release. Builds at or above 8.3.70.68 include the fix."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avira antivirus engine heap buffer OOB read when scanning a malformed PDF file (variant 2)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2025-7002",
"datePublished": "2026-06-12T21:59:52.538Z",
"dateReserved": "2025-07-02T07:27:26.206Z",
"dateUpdated": "2026-06-12T21:59:52.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}