Avira Antivirus CVE-2025-9032

Attacker must get a specifically malformed Windows PE file (.exe/.dll) onto a filesystem location that Avira's on-access scanner monitors, OR convince the user/administrator to trigger a manual or scheduled scan of the file - this is the UI:R element. The vulnerable code path is the engine's PE parser, so non-PE file formats do not trigger it. Limiting factors: only Avira engine builds before 8.3.70.98 are vulnerable; auto-update of the engine closes the window quickly for connected endpoints; and because the attack vector is AV:L, the file must reach the local disk (no purely remote network exploitation against the engine itself). The vendor's 'Local Execution of Code' claim presumes the OOB read can be turned into control of execution, which for a read-only primitive typically requires additional heap-layout control not documented in the advisory.

CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack vector with required user interaction but high impact across confidentiality, integrity, and availability - consistent with code execution inside the AV engine process, which typically runs at high privilege (SYSTEM on Windows, root on Linux/macOS). The 'local + UI:R' framing is somewhat misleading for AV products: any file written to a monitored directory is auto-scanned, so the 'interaction' is effectively the victim merely receiving or saving a file, lowering the practical bar. No EPSS score or KEV listing was provided, and no public exploit identified at time of analysis, so this currently looks like a high-severity but not yet weaponized issue. The CWE-125 out-of-bounds READ is more likely to yield denial-of-service or information disclosure than reliable code execution - the vendor's claim of 'Local Execution of Code' should be treated as a worst-case outcome unless a PoC demonstrates it.

An attacker emails a malformed Windows PE file (or hosts it on a webpage / file share) to a target whose endpoint runs Avira; when the file lands on disk, the Avira on-access scanner parses it and triggers the out-of-bounds read, crashing the engine process or - in the worst case claimed by the vendor - executing attacker-controlled code with the engine's elevated privileges. No public exploit identified at time of analysis, so the realistic near-term outcome is denial-of-service of the AV (leaving the host unprotected) rather than reliable RCE.