Avast Antivirus CVE-2025-7004

Requires that a malformed Windows PE file reach a vulnerable endpoint where the Gen Digital antivirus engine (Avast, AVG, Norton, Avast One, or Avast Business) is running a virus definition build older than VPS 25040308 AND that the engine actually parses the file - which happens automatically through on-access/real-time scanning when the file is written, opened, or executed, satisfying the CVSS UI:R requirement without explicit user double-click. No authentication is required (PR:N) and no special product configuration is needed beyond having real-time scanning enabled, which is the default. Limiting factors: the attacker must get the file onto the endpoint (local attack vector AV:L, not remote network exploitation), the target's definitions must be below VPS 25040308, and on macOS/Linux exploitation is conditional on whether the installed product actually invokes the PE parser by default for scanned files.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a local attack vector requiring user interaction with high impact across CIA - consistent with an antivirus engine that scans a file the user (or an automated process) drops on disk. PR:N combined with UI:R indicates that no prior authentication is needed but a file must be made available for scanning, which is trivially achievable in real-world workflows (downloads, email attachments, USB media). No EPSS score, KEV listing, or public POC was provided, suggesting the issue is not under broad opportunistic exploitation today, but the very wide install base (consumer Norton/Avast/AVG plus Avast Business) and the engine-level privilege of AV scanners make this a meaningful priority. Note the apparent tension between the description, which lists Windows, macOS, and Linux, and the description's framing around scanning a Windows PE file - exploitation requires the engine to actually parse PE binaries on the host platform, which is normal on Windows but conditional on AV configuration on macOS/Linux; defenders should verify with the vendor whether non-Windows builds invoke the same parser by default.

An attacker crafts a malformed Windows PE file with corrupted header fields that trigger the out-of-bounds heap write in the AV parser, then delivers it to a victim endpoint via phishing attachment, drive-by download, USB drop, or shared network path. When the antivirus engine automatically scans the file on-access, the malformed PE corrupts heap memory inside the scanner process, leading to either a crash that disables AV protection or, with reliable heap grooming, arbitrary code execution in the security context the AV engine runs under. No public exploit identified at time of analysis.