What is the CVSS score of CVE-2025-7007?

CVE-2025-7007 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-7007?

A NULL Pointer Dereference vulnerability in Avast Antivirus (macOS version 16.0.0 and Linux version 3.0.3) allows attackers to crash the antivirus process by submitting malformed Windows PE files,…

Is there a public PoC exploit available for CVE-2025-7007?

Yes, a public proof-of-concept exploit is available for CVE-2025-7007. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7007?

Within 24 hours: Identify all endpoints running Avast Antivirus versions 16.0.0 (macOS) or 3.0.3 (Linux) and restrict file scanning of untrusted PE files from external sources. Within 7 days: Contact Avast support for patch availability and interim security guidance; consider deploying alternative antivirus solutions on critical systems if patches remain unavailable. Within 30 days: Apply vendor patches immediately upon release, or migrate affected systems to patched Avast versions or alternative endpoint protection solutions.

Windows CVE-2025-7007

EUVD-2025-200065 HIGH

NULL Pointer Dereference (CWE-476)

2025-12-01 security@nortonlifelock.com

Windows Denial Of Service Null Pointer Dereference Apple macOS Microsoft

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200065

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Dec 02, 2025 - 17:16 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 17:15 nvd

HIGH 7.5

DescriptionNVD

NULL Pointer Dereference vulnerability in Avast Antivirus on MacOS, Avast Anitvirus on Linux when scanning a malformed Windows PE file causes the antivirus process to crash.This issue affects Antivirus: 16.0.0; Anitvirus: 3.0.3.

Analysis

Technical ContextAI

A NULL pointer dereference occurs when the application attempts to use a pointer that has not been initialized or has been set to NULL.

RemediationAI

Add NULL checks before pointer dereference operations. Use static analysis to identify potential NULL pointer issues. Enable compiler warnings.

More from same product – last 7 days

CVE-2026-10044 HIGH This Week POC

8.2 May 28

{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat

CVE-2026-40412 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil

CVE-2026-41104 CRITICAL Monitor

10.0 May 22

Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal

CVE-2026-23652 CRITICAL Monitor

10.0 May 22

Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-

CVE-2026-47280 CRITICAL Monitor

10.0 May 22

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti

CVE-2025-7007 vulnerability details – vuln.today

Back

Windows CVE-2025-7007

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

Analysis

Technical ContextAI

RemediationAI

More from same product – last 7 days

Share

External POC / Exploit Code