EUVD-2025-210124
GHSA-c5xp-jrpg-96g4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local because the malformed PE must reach the endpoint; UI:R as a file must be presented for scanning; PR:N since the scanner auto-parses; full CIA impact at AV process privilege.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of service when the engine parses a malformed Windows PE file, affecting Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux on virus definition builds prior to VPS 25040308. Because the flaw lives in the scanner that typically runs with elevated privileges, successful exploitation can escalate to code execution in a high-privilege security context. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-787 (out-of-bounds write) on the heap inside the PE (Portable Executable) file parser used by the Gen Digital antivirus engine. PE is Microsoft's executable container format whose headers (DOS stub, NT headers, section tables, data directories) drive size and offset calculations during parsing; a malformed field can trick the parser into computing a destination buffer that is too small or a write length that is too large, corrupting adjacent heap structures. The vulnerable parser is delivered as part of the shared virus definition update stream (VPS), so a single engine bug propagates simultaneously to every Gen Digital consumer product that embeds it - Avast, AVG, Norton, Avast One, and Avast Business - across Windows, macOS, and Linux as indicated by the listed CPEs (gen_digital:avast_antivirus, avg_antivirus, norton_antivirus, avast_one, avast_business_antivirus).
RemediationAI
Vendor-released patch: virus definition build VPS 25040308 or later, delivered automatically through the Gen Digital VPS update stream - confirm that auto-update is enabled and that endpoints have actually pulled a definition build at or above VPS 25040308 (the engine version, not the product installer version, is what matters). Because mitigation flows through the definition channel rather than a product upgrade, no traditional installer rollout is required; fleet operators should query their management console for the current VPS build on each endpoint and force an update on stragglers. Until every endpoint reports VPS 25040308+, compensating controls are limited because disabling on-access scanning would defeat the purpose of the AV product, but high-risk hosts can be temporarily configured to exclude untrusted directories from real-time PE scanning (trade-off: malicious binaries dropped there will not be caught) or to route untrusted files through a sandboxed analysis pipeline before they touch the endpoint. Reference: https://www.gendigital.com/us/en/contact-us/security-advisories/.
More in Avast Antivirus
View allThe TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation in Avast Antivirus 25.11 allows non-privileged Windows users to execute arbitrary code as SYS
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files
Stack overflow in Gen Digital's shared antivirus scanning engine crashes the AV process when it parses a malformed Offic
Stack overflow via uncontrolled recursion crashes the antivirus scanning process across all Gen Digital consumer and bus
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a spec
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today