EUVD-2025-210125
GHSA-w5xg-24x3-2465
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local delivery of malformed PE required (AV:L); no credentials needed but user must trigger scan (PR:N, UI:R); impact is AV process crash only (A:H, C:N, I:N).
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25031700.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a specially crafted malformed Windows PE file, causing a Denial-of-Service across five Gen Digital products - Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus - on Windows, macOS, and Linux. The vulnerability resides in the virus definition update stream rather than the product binary itself, meaning all five products sharing the same Gen Digital VPS stream are simultaneously exposed until updated to definition build VPS 25031700 or later. No public exploit code has been identified at time of analysis, and CVSS scores this at medium severity (5.5) reflecting local access and required user interaction as meaningful limiting factors.
Technical ContextAI
The root cause is CWE-674 (Uncontrolled Recursion): the PE file parser within the shared Gen Digital scanning engine enters recursive processing when it encounters a specially malformed PE structure, lacking a depth limit or recursion guard that would terminate the loop. Because the scanning logic is delivered via a shared virus definition update stream (VPS - Virus Protection Signatures), the flaw is architectural at the signature/engine layer rather than the product layer. This explains why five distinct products across three operating systems are simultaneously affected: cpe:2.3:a:gen_digital:avast_antivirus, cpe:2.3:a:gen_digital:avg_antivirus, cpe:2.3:a:gen_digital:norton_antivirus, cpe:2.3:a:gen_digital:avast_one, and cpe:2.3:a:gen_digital:avast_business_antivirus. The Windows PE (Portable Executable) format allows complex nested structures (e.g., resource directories, import tables) that a recursive parser can descend into indefinitely if the file is maliciously or accidentally malformed, ultimately exhausting the call stack and causing an unhandled exception or crash in the antivirus process.
RemediationAI
The primary fix is a virus definition update to VPS build 25031700 or later, delivered automatically through the standard Gen Digital definition update channel. Administrators should verify that all managed endpoints have received and applied VPS 25031700 or above - this can be confirmed through the AV management console's definition version reporting. For systems with automatic updates enabled and network connectivity, no manual intervention is required. For air-gapped or update-restricted environments, administrators should manually push VPS 25031700 or later from an offline update package obtained from the Gen Digital support portal (see https://www.gendigital.com/us/en/contact-us/security-advisories/). As a compensating control in environments where the definition update cannot be immediately applied, temporarily disabling real-time on-access scanning of PE files or restricting scanning of untrusted PE files from network shares reduces exposure, but note this also reduces malware detection capability during the window. There is no binary patch required - the fix is entirely in the definition build.
More in Avast Antivirus
View allThe TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation in Avast Antivirus 25.11 allows non-privileged Windows users to execute arbitrary code as SYS
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files
Stack overflow in Gen Digital's shared antivirus scanning engine crashes the AV process when it parses a malformed Offic
Stack overflow via uncontrolled recursion crashes the antivirus scanning process across all Gen Digital consumer and bus
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today