Avast Antivirus CVE-2025-7019

Exploitation requires the target system to be running one of the five affected Gen Digital antivirus products with a virus definition build prior to VPS 25020100. A malformed OOXML file must be delivered to the system and scanned by the engine - this can occur via on-access scanning when a file is opened (satisfying UI:R) or via on-demand scan. No special system privileges are needed by the attacker to trigger the scan (PR:N), but local presence of the file and a user interaction event are required (AV:L, UI:R). Exploitation is limited to crashing the antivirus process (DoS only); there is no code execution path confirmed. Systems with automatic definition updates at VPS 25020100 or above are not vulnerable regardless of product version.

The CVSS 3.1 score of 5.5 (Medium) accurately reflects the constrained impact profile: attack vector is Local (AV:L), requiring a malformed file to reach the target system and be scanned, with user interaction required (UI:R). There is no privilege escalation, no code execution, and no data exposure - impact is confined to crashing the antivirus process (A:H, C:N, I:N). No EPSS data was provided in the intelligence feed, and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation exists at time of analysis. No public proof-of-concept exploit code has been identified. The practical risk to most organizations is low-to-moderate: a DoS of the AV process is disruptive and leaves the endpoint temporarily unprotected, but the attack requires file delivery and a local scan trigger. The remediation path is frictionless - virus definition auto-updates push the fix through the same channel that delivered the vulnerable code, meaning most managed and consumer endpoints are likely already patched without user action.

An attacker crafts a specially malformed Office Open XML file (.docx or similar) designed to trigger a stack overflow in the Gen Digital parser and delivers it to a target via email attachment, download link, or shared storage. When the victim opens or saves the file - or when on-access scanning automatically processes it - the antivirus engine's OOXML parser overflows its stack and the AV process crashes. No public exploit code has been identified, but the trigger condition (malformed OOXML file + scan event) is straightforward to engineer given the well-understood OOXML format.