EUVD-2025-210129
GHSA-vf74-69rc-vmq4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
AV:L reflects that the malicious PDF must reside on the local filesystem; PR:N because no account privileges are required to introduce a scanned file; UI:R because a user action (download, receive, or open) is needed to place the file; A:H for full crash of the AV process; no confidentiality or integrity impact.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021208.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Stack overflow via uncontrolled recursion crashes the antivirus scanning process across all Gen Digital consumer and business products when a crafted malformed PDF is scanned. Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux are all affected through a shared Gen Digital virus definition engine (VPS builds before 25021208). An attacker who can place a specially crafted PDF on a target system - or deliver it via email or download - can force a denial-of-service of the antivirus process; no public exploit has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-674 (Uncontrolled Recursion), a class of vulnerability where a parser fails to bound recursive call depth when processing nested or self-referential structures. PDF is a format that supports recursive object references and deeply nested tree structures (e.g., page content streams, object cross-references, linearization structures); a malformed PDF can exploit this by encoding pathologically deep nesting that exhausts the call stack. The affected logic resides in the shared Gen Digital virus definition stream rather than the base antivirus engine binary - meaning the same vulnerable scanning code is delivered via VPS update to all five identified CPE targets: cpe:2.3:a:gen_digital:avast_antivirus, cpe:2.3:a:gen_digital:avg_antivirus, cpe:2.3:a:gen_digital:norton_antivirus, cpe:2.3:a:gen_digital:avast_one, and cpe:2.3:a:gen_digital:avast_business_antivirus, across Windows, macOS, and Linux platforms. This shared-engine architecture means a single definition update both introduced and resolves the vulnerability across all affected product lines simultaneously.
RemediationAI
The primary fix is delivered through the Gen Digital virus definition (VPS) update stream - installations at or above build VPS 25021208 are not vulnerable regardless of the base product version or platform. Administrators should verify that auto-update of virus definitions is enabled and confirm the installed VPS build number meets or exceeds 25021208 through the product console or management dashboard. For managed enterprise deployments using Avast Business Antivirus, ensure the definition update policy is not paused or bandwidth-throttled in a way that delays receipt of the remediated definitions. As a compensating control where immediate update is not possible, temporarily disabling on-access PDF scanning or restricting the scanning engine from processing PDF files can prevent exploitation, though this reduces detection capability for PDF-embedded malware and should be treated as a short-term measure only. Consult the Gen Digital advisory at https://www.gendigital.com/us/en/contact-us/security-advisories/ for official confirmation of build thresholds.
More in Avast Antivirus
View allThe TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation in Avast Antivirus 25.11 allows non-privileged Windows users to execute arbitrary code as SYS
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files
Stack overflow in Gen Digital's shared antivirus scanning engine crashes the AV process when it parses a malformed Offic
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a spec
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today