Avast Antivirus CVE-2025-7006

The on-access or on-demand scanner must process the malformed PE file, requiring a local user to open, execute, or otherwise interact with the crafted file (UI:R in CVSS). The product must be running a virus definition build prior to VPS 25022500. No elevated privileges are required to place a file that the scanner will inspect. The vulnerability is limited to the PE file parsing code path, so only files presenting as Windows PE binaries (EXE, DLL, etc.) trigger it; other file types processed by the scanner are not affected by this specific flaw. Exploitation is further limited to a Denial-of-Service of the antivirus process - there is no code execution, privilege escalation, or data exposure component. On systems where the antivirus process auto-restarts after a crash, the effective availability impact is transient.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 Medium and accurately conveys the threat profile: exploitation is local and requires user interaction, substantially reducing the attack surface compared to a network-reachable vulnerability. The availability impact is high but scoped to the antivirus process alone, not the underlying OS. No EPSS score was provided in the intelligence data, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified at time of analysis. Together these signals indicate this is a legitimate but lower-priority issue: the primary risk scenario is a malicious file disabling antivirus protection as part of a broader attack chain, rather than direct system compromise. The shared delivery mechanism is noteworthy - a single definition update both introduces and patches the flaw across the entire Gen Digital product family, which limits the window of exposure for installations with automatic updates enabled.

An attacker crafts a specially malformed Windows PE file designed to trigger the vulnerable stack memory management code path in the Gen Digital parser, then delivers it to a target system via email attachment, download link, or removable media. When the user accesses the file, the antivirus engine automatically scans it, hits the use-after-free condition, and crashes the antivirus process. No public proof-of-concept has been identified at time of analysis, but the attack primitive - a crafted PE triggering a parser crash - is a well-understood technique in antivirus fuzzing research.