EUVD-2025-210136
GHSA-575m-c8qr-pcg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malformed MS-DOS executable
-
DeliveryDeliver file to target system
-
ExploitAvira engine auto-scans on access
-
InstallInteger overflow in MZ parser
-
C2Heap out-of-bounds write corrupts engine memory
-
ExecuteHijack control flow in AV process
-
ImpactExecute code as SYSTEM/root or crash engine
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Avira Antivirus engine (build below 8.3.70.104) actually scan a malformed MS-DOS executable crafted to trigger the integer overflow in the MZ parser; this typically happens automatically via on-access/real-time protection when the file lands on disk, or via an explicit scan. Limiting factors per the CVSS vector: AV:L means the file must reach the local system (delivered via email attachment, download, USB, network share, etc.) and UI:R reflects that some user or system action causes the file to be scanned, while PR:N means no prior authentication to the AV product is needed. Disabling real-time scanning, or operating engine builds 8.3.70.104+, removes the exposure. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) reflects that the vulnerable code path is reached through file-scanning, which from the attacker's perspective looks like a local-with-user-interaction primitive even though the malicious file can arrive via any vector (email, download, USB). EPSS data and KEV status were not provided, but Gen Digital is the sole reporter and no public exploit identified at time of analysis, so this is currently a reported-but-not-yet-weaponized issue. Real-world risk is meaningful because AV engines typically run with SYSTEM/root privileges and auto-scan untrusted files, effectively turning UI:R into 'drop a file anywhere it gets scanned'; however, absent KEV/POC signals this should be treated as a high-priority patch rather than an emergency. The single advisory link is a generic Gen Digital security-advisories page rather than a per-CVE bulletin, so detailed IOCs and exact disclosure timeline are not independently verifiable. |
| Exploit ScenarioDerived | An attacker emails or drops a specially crafted MS-DOS executable onto a target endpoint (or stages it on a network share, USB, or web download); when Avira's real-time protection automatically scans the file, the malformed MZ header triggers the integer overflow and out-of-bounds heap write inside the engine process. With reliable heap grooming the attacker achieves code execution in the AV engine context - typically SYSTEM on Windows or root on Linux/macOS - or at minimum crashes the engine to blind defenses; no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to trigger a heap buffer out-of-bounds write by having the engine scan a malformed MS-DOS executable. The flaw stems from an integer overflow during parsing and can also crash the antivirus engine process, with no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Avira Antivirus engine build 8.3.70.104 or later - update the antivirus engine on all Windows, macOS, and Linux endpoints via the standard Avira/Gen Digital update channel and verify the engine version post-update, since product UI versions differ from engine builds. Refer to the Gen Digital security advisories page at https://www.gendigital.com/us/en/contact-us/security-advisories/ for the formal bulletin. As a temporary compensating control where immediate update is not possible, restrict the AV from scanning untrusted/quarantine directories containing unvetted MZ executables or disable on-access scanning of legacy MS-DOS executables; note this materially weakens malware coverage and should only bridge the time until the engine update propagates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Avira's scanning engine (cpe:2.3:a:gen_digital:avira_antivirus), specifically the parser that processes MS-DOS executable (MZ) headers. An integer overflow occurs while computing a size or offset value from attacker-controlled fields in a crafted MZ binary, producing a smaller-than-expected heap allocation or wrap-around index that is subsequently used in a copy operation. This is a classic CWE-787 out-of-bounds write on the heap, where corrupted adjacent metadata (chunk headers, function pointers, vtables in the scan engine process) can be leveraged for control-flow hijack on Windows, macOS, and Linux engine builds prior to 8.3.70.104.
Know when Avira Antivirus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file must reach the host (AV:L) and be scanned via user/system action (UI:R); no AV auth needed (PR:N); engine runs with high privilege so successful OOB write yields full C/I/A impact.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
2DescriptionCVE.org
Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.
Executive ViewAI
Avira Antivirus versions before 8.3.70.104 on Windows, macOS, and Linux contain a local code execution vulnerability that allows attackers to compromise the antivirus engine itself, disabling endpoint security controls. Organizations running affected versions face potential loss of endpoint protection and security visibility across multiple operating systems. This directly undermines endpoint defense infrastructure and creates a critical gap in organizational security posture.
Apply vendor patch: Upgrade to Avira Antivirus 8.3.70.104 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Avira Antivirus
View allLocal code execution in Avira Antivirus engine builds prior to 8.3.27.12 on Windows, macOS, and Linux occurs when the sc
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Null pointer dereference in the Avira Antivirus scanning engine crashes the antivirus process when it parses a specially
Exploit-DB