Avast Antivirus CVE-2025-7005

Exploitation requires the following specific conditions: (1) the target system must be running one of the five named Gen Digital products with virus definitions older than VPS 25031700; (2) a malformed Windows PE file must be present on the local filesystem or accessible storage - the file does not need to be a functional executable; (3) user interaction (UI:R per CVSS) is required, meaning the user must perform an action that triggers AV scanning of the malformed file, such as opening, downloading, or manually scanning it. Limiting factors: the attack vector is local (AV:L), so the attacker must first deliver the malformed PE to the target system through a separate channel (phishing, USB, network share); real-time scanning on most products may trigger automatically on file write, but the CVSS UI:R designation from the vendor indicates some user action is required; the impact is limited to crashing the AV process only - it does not grant code execution, privilege escalation, or access to system resources; endpoints with automatic definition updates enabled and VPS 25031700 or higher are fully remediated and not exploitable.

Real-world risk is moderate-to-low for most enterprise environments. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H constrains exploitation to local file delivery with required user interaction, limiting automated mass exploitation. The impact is strictly availability - crashing the AV process - with no confidentiality or integrity consequences. EPSS data was not provided in the input; given the local vector, user-interaction requirement, and lack of KEV listing, real-world exploitation probability is likely low. There is no CISA KEV listing and no public exploit code identified at time of analysis. The most significant risk factor is the broad product surface: five consumer and business AV products across three OS platforms share the vulnerable definition stream, meaning the exploitable population is very large even if per-instance risk is limited. The mitigating factor is that Gen Digital's automatic update mechanism - the same channel that introduced the flaw - also delivers the fix, and most installations with live updates enabled will have already received VPS 25031700. The primary residual risk population is air-gapped systems, update-disabled deployments, or environments where definition updates are staged and delayed.

An attacker delivers a specifically crafted malformed Windows PE file to a target machine - for example, as an email attachment, a downloaded file, or a file placed on a shared drive - and waits for the victim to open or interact with the file, triggering the antivirus real-time or on-demand scanner. The scanner's PE parsing logic enters uncontrolled recursion processing the malformed structure, exhausts the process stack, and the antivirus process crashes, leaving the endpoint temporarily unprotected. No public proof-of-concept exists at time of analysis, but crafting malformed PE files to trigger parser edge cases is well-understood in the security research community.