Avast Antivirus CVE-2025-7009

Exploitation requires that a malformed Windows PE file reach a filesystem path that the Gen Digital scanning engine processes - typically any path covered by real-time/on-access protection, or any path the user invokes an on-demand scan against - on an installation whose virus definition build is below VPS 25021310. The CVSS vector's UI:R reflects that the malformed file must be introduced to the host (download, email attachment, USB, share, or manual scan request) rather than the attacker invoking the scanner directly; PR:N means no account on the target is needed. Limiting factors: the engine only triggers on PE-format input, the bug is patched purely via the definitions update channel so any host whose definitions auto-update will self-heal, and AV:L confines the attack to local file processing rather than a remote network listener.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local attack surface with high impact, gated only by user interaction - consistent with on-access AV scanning kicking in when a malformed PE arrives on disk via download, email, USB, or a network share. There is no EPSS, KEV, or POC signal in the supplied data, so this is best treated as a high-impact-but-not-yet-exploited bug; the privileged context of AV engines makes it an attractive target should an exploit emerge. The PR:N + UI:R combination is worth scrutinizing: 'no privileges' is technically correct because the attacker does not need an account, but real-world exploitation still requires getting the malformed file into a path the scanner will touch, which in practice may not require any conscious user click on endpoints with real-time protection. No vendor advisory URL beyond the generic Gen Digital security-advisories landing page was provided, so the granular per-product fix metadata could not be independently cross-referenced.

An attacker crafts a malformed Windows PE file and delivers it to a target endpoint via phishing attachment, drive-by download, removable media, or a writable network share. The Gen Digital real-time scanner automatically parses the PE on file landing, triggers the heap out-of-bounds read in the parser, and either crashes the AV engine (degrading protection) or, with reliable heap shaping, achieves code execution in the privileged scanning process. No public exploit identified at time of analysis, but the on-access scan path means user 'interaction' may amount to nothing more than receiving the file.