EUVD-2025-210133
GHSA-5rmp-977f-x986
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file scan trigger requires no privileges but demands user interaction; impact is strictly availability (AV process crash), with no confidentiality or integrity effect.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
3DescriptionCVE.org
Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Stack overflow in Gen Digital's shared antivirus scanning engine crashes the AV process when it parses a malformed Office Open XML (OOXML) file, causing a Denial-of-Service condition. The flaw affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux - all products that consume the same Gen Digital VPS (virus definition) update stream. No active exploitation or public exploit code has been identified at time of analysis; the impact is limited to availability (AV process crash) with no confidentiality or integrity consequences.
Technical ContextAI
The root cause is CWE-121 (Stack-based Buffer Overflow) within the Office Open XML parsing logic embedded in Gen Digital's shared virus definition engine. OOXML is the container format used by Microsoft Office documents (.docx, .xlsx, .pptx); its complex ZIP-based structure with nested XML streams presents a large attack surface for malformed input. The vulnerable parsing code is not product-specific - it is delivered via a centralized VPS (virus pattern/signature) update stream shared across all Gen Digital consumer and business antivirus products. Affected CPEs span five product lines under the gen_digital vendor namespace: cpe:2.3:a:gen_digital:avast_antivirus, avg_antivirus, norton_antivirus, avast_one, and avast_business_antivirus - all with wildcard version ranges indicating broad version exposure prior to the definition fix.
RemediationAI
The primary fix is ensuring virus definitions are updated to VPS 25020100 or later. Because the vulnerable scanning logic is delivered through Gen Digital's automated VPS update stream, installations with automatic definition updates enabled will receive the fix without manual intervention - administrators should verify that endpoints are not blocking definition updates or running in offline/air-gapped mode. For environments where definition updates are managed centrally (e.g., Avast Business), confirm the VPS build version in the management console is at or above 25020100. There is no documented workaround for disabling OOXML scanning selectively without impairing protection; the recommended mitigation for air-gapped systems is to manually push the VPS 25020100 definition package via the vendor's offline update mechanism. Refer to the Gen Digital advisory at https://www.gendigital.com/us/en/contact-us/security-advisories/ for distribution-specific guidance.
More in Avast Antivirus
View allThe TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
Local privilege escalation in Avast Antivirus 25.11 allows non-privileged Windows users to execute arbitrary code as SYS
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files
Stack overflow via uncontrolled recursion crashes the antivirus scanning process across all Gen Digital consumer and bus
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a spec
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today