Avast Antivirus CVE-2025-7008

Requires that the target endpoint scan an attacker-controlled Windows PE file containing crafted .NET (CLR) metadata using a Gen Digital antivirus product (Avast, AVG, Norton, Avast One, or Avast Business Antivirus) on Windows, macOS, or Linux whose VPS virus definition build is below 25021310; the PE must carry a COM/CLR header so the vulnerable .NET metadata parser is invoked - a plain native PE without .NET metadata does not reach the bug. Exploitation is limited by CVSS AV:L (the malicious file must reach local disk or a scanned path, not be triggered purely over the network), by UI:R (user interaction in the form of file delivery/scan trigger), and by the fact that any installation already at or above VPS 25021310 is not vulnerable regardless of which Gen Digital product consumes the stream. No authentication is required of the attacker (PR:N), but they must induce the victim's AV engine to scan their file.

CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local vector with required user interaction but full CIA impact if code execution is achieved - consistent with a parser bug in a privileged scanner. There is no EPSS score, KEV listing, or POC reference provided, and the only reference is the generic Gen Digital advisories index rather than a per-CVE bulletin, so real-world exploitation pressure appears low. The vendor's own wording is hedged ('may allow Local Execution of Code OR Denial-of-Service'), suggesting the primary observed behavior is a crash and that RCE is theoretical pending weaponization of the OOB read - a heap OOB *read* (CWE-125) is typically easier to turn into infoleak/DoS than into arbitrary execution. Net: a real patch priority because the bug lives in always-on AV, but not an emergency; treat as 'patch in the next update cycle' rather than 'drop everything.'

An attacker emails or hosts a crafted Windows PE binary with malformed .NET metadata; when the file lands on a target endpoint, the Avast/AVG/Norton on-access scanner automatically parses it and reads past a heap buffer, at minimum killing the AV service (creating a blind spot for follow-on malware) and potentially yielding local code execution in the scanner's privileged context. The CVSS UI:R requirement is satisfied passively - the 'user interaction' is simply receiving or opening a directory containing the file, not deliberately running it. No public exploit identified at time of analysis.