Avast Antivirus CVE-2025-7010

Exploitation requires that a malformed PDF file be present on the target filesystem in a location monitored by the antivirus on-access scanner, or that a user open or access such a file triggering a manual or scheduled scan. The vulnerability is present only in installations running a VPS definition build prior to 25021208 - systems with current definition updates are not vulnerable. The vulnerability affects default scanning configurations; no non-default feature flag or special configuration is required to be exploitable. What limits exploitation: the AV process crash results only in a denial-of-service of that process (not OS-level code execution), and modern operating systems will typically restart the AV service after a crash, bounding the availability window. Exploitation is further limited to the five named Gen Digital product families on Windows, macOS, and Linux - other antivirus engines are not affected by this definition update.

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H appropriately captures the constrained but real-world risk. The local attack vector (AV:L) does not mean physical access is required - it reflects that the malformed PDF must reside on the local filesystem before the scanner processes it, a condition trivially achieved via email attachment, web download, or file share. PR:N accurately reflects that no account privileges are needed to introduce a file into a scanned path. The availability impact is high (A:H) against the antivirus process itself, but scope is unchanged (S:U), limiting damage to that single process rather than cascading to the OS. The practical consequence of crashing the AV process is loss of real-time protection, which is significant in environments where security posture depends on continuous scanning. No EPSS score was provided, KEV status is absent, and no POC has been identified - these omissions suggest opportunistic exploitation is not currently observed, but the breadth of the affected product surface (five major consumer/business AV brands across three platforms, likely representing hundreds of millions of endpoints) warrants prompt definition update verification. The shared-engine delivery model is a double-edged factor: it amplifies exposure but also allows a single VPS build update to remediate all products simultaneously.

An attacker crafts a malformed PDF file with pathologically deep recursive object references exceeding the antivirus scanner's stack capacity. The file is delivered to the target via email, malicious download link, or a shared network path, and when the on-access scanner automatically processes the file upon creation or access, the PDF parser enters uncontrolled recursion, exhausts the process stack, and crashes the antivirus process. The result is a loss of real-time antivirus protection on the affected host, which could be used as a precursor to follow-on malware delivery; no public proof-of-concept has been identified at time of analysis.