EUVD-2025-210133
GHSA-5rmp-977f-x986
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file scan trigger requires no privileges but demands user interaction; impact is strictly availability (AV process crash), with no confidentiality or integrity effect.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Stack overflow in Gen Digital's shared antivirus scanning engine crashes the AV process when it parses a malformed Office Open XML (OOXML) file, causing a Denial-of-Service condition. The flaw affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux - all products that consume the same Gen Digital VPS (virus definition) update stream. No active exploitation or public exploit code has been identified at time of analysis; the impact is limited to availability (AV process crash) with no confidentiality or integrity consequences.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow) within the Office Open XML parsing logic embedded in Gen Digital's shared virus definition engine. OOXML is the container format used by Microsoft Office documents (.docx, .xlsx, .pptx); its complex ZIP-based structure with nested XML streams presents a large attack surface for malformed input. The vulnerable parsing code is not product-specific - it is delivered via a centralized VPS (virus pattern/signature) update stream shared across all Gen Digital consumer and business antivirus products. Affected CPEs span five product lines under the gen_digital vendor namespace: cpe:2.3:a:gen_digital:avast_antivirus, avg_antivirus, norton_antivirus, avast_one, and avast_business_antivirus - all with wildcard version ranges indicating broad version exposure prior to the definition fix.
RemediationAI
The primary fix is ensuring virus definitions are updated to VPS 25020100 or later. Because the vulnerable scanning logic is delivered through Gen Digital's automated VPS update stream, installations with automatic definition updates enabled will receive the fix without manual intervention - administrators should verify that endpoints are not blocking definition updates or running in offline/air-gapped mode. For environments where definition updates are managed centrally (e.g., Avast Business), confirm the VPS build version in the management console is at or above 25020100. There is no documented workaround for disabling OOXML scanning selectively without impairing protection; the recommended mitigation for air-gapped systems is to manually push the VPS 25020100 definition package via the vendor's offline update mechanism. Refer to the Gen Digital advisory at https://www.gendigital.com/us/en/contact-us/security-advisories/ for distribution-specific guidance.
More from same product – last 7 days
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a spec
Share
External POC / Exploit Code
Leaving vuln.today