EUVD-2025-210134
GHSA-xwvr-mg4x-vxqq
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must reach local disk (AV:L) and be scanned (UI:R); no auth needed (PR:N); engine runs at high privilege so successful exploitation yields full C/I/A impact.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.
AnalysisAI
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70.98) allows a malformed Windows PE file to trigger local code execution or crash the antivirus engine process. Because AV engines typically auto-scan files on access, simply writing or dropping a crafted PE onto disk can reach the vulnerable parser, and no public exploit identified at time of analysis. Exploitation requires the victim's AV to scan the file (UI:R), so realistic delivery is via downloads, email attachments, or removable media rather than fully remote unauthenticated execution.
Technical ContextAI
The vulnerability is a CWE-125 out-of-bounds read in the heap, occurring inside Avira's PE (Portable Executable) file parser within the antimalware scanning engine. PE parsers must validate numerous size, offset, and section header fields embedded in the Windows executable format; a malformed value (e.g., truncated headers, oversized section counts, or out-of-range RVAs) can cause the parser to read past an allocated heap buffer. Per the CPE (cpe:2.3:a:gen_digital:avira_antivirus), the affected component is the Gen Digital-maintained Avira engine shared across Windows, macOS, and Linux endpoint products, meaning the same parser code path is reachable on all three platforms despite PE being a Windows-native format - AV engines parse PE on every OS to detect Windows malware on file shares, mail gateways, and cross-platform scans.
RemediationAI
Vendor-released patch: Avira Antivirus engine 8.3.70.98 or later - update the scanning engine on all Windows, macOS, and Linux endpoints to this build or newer, consulting the advisory at https://www.gendigital.com/us/en/contact-us/security-advisories/. Engine updates are normally delivered automatically through the Avira update channel, so verify that auto-update is enabled and that endpoints have successfully received the new engine version (administrators in managed deployments should confirm via their console). As a temporary compensating control where the engine cannot be updated immediately, restrict ingestion of untrusted PE files (block executable attachments at the mail gateway, disallow .exe/.dll uploads to file shares scanned by Avira), accepting that this reduces normal workflow for software installers; disabling on-access scanning is not recommended because it removes the AV's core protective function.
More from same product – last 7 days
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Share
External POC / Exploit Code
Leaving vuln.today