EUVD-2025-210123
GHSA-98r3-fv2h-4h72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malformed PDF via email or download
-
DeliveryFile written to monitored disk location
-
ExploitAvira on-access scanner auto-parses PDF
-
ExecutionOut-of-bounds heap read triggered in engine
-
PersistEngine process crashes or executes attacker code
-
ImpactCode runs in AV service context (SYSTEM/root)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Avira Antivirus scanning engine (build before 8.3.70.56) to parse an attacker-supplied malformed PDF file. The CVSS UI:R requirement is satisfied implicitly because on-access scanning auto-invokes the engine whenever a PDF is written to disk (download, email attachment save, USB transfer), so 'user interaction' reduces to the user receiving or fetching the file rather than explicitly opening it. Limiting factors: the Avira engine must be installed and active with PDF scanning enabled (default on); the engine build must be older than 8.3.70.56; and converting the out-of-bounds read into reliable code execution is non-trivial - denial-of-service of the engine process is the more reliable outcome. Platform is not a meaningful limit because Windows, macOS, and Linux engines are all affected. |
| Impact | Signals are mixed-but-meaningful: CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a locally-vectored issue requiring user interaction, but the 'UI:R' here is satisfied trivially because antivirus engines auto-scan files dropped to disk - so an emailed or downloaded PDF can be enough. There is no public exploit identified at time of analysis, the CVE is not on CISA KEV, and no EPSS score was supplied in the input, which collectively suggests this is not yet a mass-exploited issue. The real priority concern is the privilege context: code execution inside the AV engine process typically means SYSTEM/root, turning a 'local' CVSS into an effective privilege-escalation primitive. Conflict to flag: CVSS labels this AV:L, but in practice the trigger file can be delivered remotely (email, web download) and scanned automatically, so AV:L understates real-world reachability - verify behavior of on-access scanning with the vendor. |
| Exploit ScenarioDerived | An attacker emails a crafted PDF to a target whose endpoint runs Avira; when the file is written to disk, Avira's on-access scanner parses it, triggering the out-of-bounds read, which either crashes the engine (leaving the host unprotected) or - if the read is shaped into a code-execution primitive - runs attacker code in the AV service context, typically SYSTEM/root. No public exploit identified at time of analysis, so weaponization would require original vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing local code execution or denial-of-service of the antivirus process on Windows, macOS, and Linux engine builds prior to 8.3.70.56. The CVSS 7.8 (High) rating reflects local attack vector with required user interaction (the engine must scan the attacker-supplied file), and no public exploit identified at time of analysis. Because the AV engine typically runs with elevated privileges, successful code execution would inherit those privileges.
RemediationAI
Upgrade the Avira Antivirus scanning engine to build 8.3.70.56 or later - this is the vendor-released patch per the CVE record; engine updates are typically delivered automatically through Avira's signature/engine update channel, so administrators should verify that engine auto-update is enabled and that endpoints have successfully pulled the new build by checking the engine version in the Avira console. Consult the Gen Digital security advisories page (https://www.gendigital.com/us/en/contact-us/security-advisories/) for the canonical advisory. If patching is delayed, compensating controls include disabling on-access scanning of PDF files at the perimeter (trade-off: removes a key detection layer for PDF-borne malware) or routing inbound PDFs through a sandboxed pre-filter so the Avira engine never parses untrusted PDFs directly (trade-off: added latency and infrastructure cost); blocking inbound PDFs at the email gateway is a heavier-handed option that breaks normal business workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in Gen Digital's Avira Antivirus scanning engine, identified by CPE cpe:2.3:a:gen_digital:avira_antivirus and classified as CWE-125 (Out-of-bounds Read). The vulnerable code path is the engine's PDF parser, which during inspection of a crafted PDF reads heap memory past the bounds of an allocated buffer. Out-of-bounds reads in parsers can leak adjacent heap data, corrupt control-flow state used by subsequent operations, or - when combined with predictable allocator behavior - be chained into memory-corruption primitives that yield code execution in the scanner process. Antivirus engines are particularly attractive targets because they auto-scan untrusted content (downloads, email attachments, files written to disk) and generally execute as a privileged service such as SYSTEM on Windows or root on Linux/macOS.
Know when Avira Antivirus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file scan trigger (AV:L), no auth (PR:N), user/auto-scan delivers file (UI:R); AC:H because turning an OOB read into code execution is non-trivial; full CIA impact via privileged AV process.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
2DescriptionCVE.org
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
Executive ViewAI
A vulnerability in Avira Antivirus scanning engine (CVE-2025-7003, CVSS 7.8) enables attackers to execute arbitrary code with the privileges of the antivirus process by distributing malformed PDF files; no public exploit identified at time of analysis. Organizations using Avira Antivirus versions prior to 8.3.70.56 on Windows, macOS, or Linux systems face risk of privilege escalation and potential compromise of critical systems. Since antivirus engines typically operate with elevated privileges, successful exploitation could provide attackers with system-level access across affected infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable PDF scanning functionality within Avira if non-essential to operations; (2) Implement file upload and transfer restrictions to limit user exposure to malformed PDFs; (3) Configure antivirus engine to run with minimal required privilege level where technically feasible; (4) Deploy behavioral detection and process monitoring tools to identify suspicious antivirus engine activity; (5) Maintain enhanced logging and real-time monitoring of affected endpoints pending patch release; (6) Implement file integrity monitoring on critical system files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Avira Antivirus
View allLocal code execution in Avira Antivirus engine builds prior to 8.3.27.12 on Windows, macOS, and Linux occurs when the sc
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Null pointer dereference in the Avira Antivirus scanning engine crashes the antivirus process when it parses a specially
Exploit-DB