Avast Antivirus CVE-2025-7011

Exploitation requires the target endpoint to run a vulnerable Gen Digital antivirus product (Avast, AVG, Norton, Avast One, or Avast Business Antivirus) with virus definition build between 25020100 and 25021207, and the attacker-controlled malformed ZIP-containing-XML must reach the scanner - typically through on-access scanning when the file is written to disk, opened, or processed by an integrated mail/web shield, satisfying the UI:R requirement. Limiting factors: the CVSS vector is AV:L, so the file must land locally rather than being scanned over the network; installations already updated to definition build 25021208 or later are not vulnerable; environments that disable on-access archive scanning further reduce reach.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a local-vector flaw where the malformed archive must reach the scanner, typically requiring user interaction such as opening, downloading, or saving the file so that on-access scanning processes it; with that step satisfied, exploitation is unauthenticated within the local trust boundary and yields high C/I/A impact, which is plausible for code execution inside an AV process that often runs with elevated privileges. EPSS, KEV, SSVC, and POC indicators were not supplied, so there is no signal of active exploitation; exploitation status is therefore no public exploit identified at time of analysis. The practical risk is meaningful because antivirus scanners auto-process untrusted files (email attachments, web downloads, USB media) which effectively lowers the bar for the UI:R requirement, but the underlying primitive is an OOB read rather than a write, so reliable code execution is uncertain and denial-of-service of the AV process is the more likely realized impact.

An attacker emails a crafted ZIP containing malformed XML to a target whose endpoint runs Avast, AVG, or Norton; when the mail client saves the attachment or the user previews it, the on-access scanner parses the archive and triggers the heap out-of-bounds read, crashing the AV process and potentially executing attacker-controlled code in its security context. The same primitive could be delivered via a drive-by download, a USB drop, or a file uploaded to a shared folder that endpoint AV automatically inspects. No public exploit identified at time of analysis.