EUVD-2026-36631
GHSA-c89p-wq36-89h3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local because the tar must reach the scanner's filesystem; UI:R since a file must be received; PR:N as the scanner auto-parses; C/I/A:H from code execution in privileged engine.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.
AnalysisAI
Local code execution in Avira Antivirus engine builds prior to 8.3.27.12 on Windows, macOS, and Linux occurs when the scanner parses a malformed POSIX tar archive, triggering a heap out-of-bounds write that can either crash the AV process (DoS) or execute attacker code in the scanner's context. No public exploit identified at time of analysis, but the on-access scanning model means a victim only has to write the malicious tar to disk for the engine to touch it. Reported by GEN (Gen Digital, Avira's parent).
Technical ContextAI
The vulnerability is rooted in Avira's archive-unpacking layer used by the scan engine across all three desktop OS builds (per the cross-platform CPE cpe:2.3:a:gen_digital:avira_antivirus:*). POSIX tar (ustar) headers carry octal-encoded size and offset fields plus extended PAX records; mishandling these length fields when copying file or header data into a heap allocation produces the classic CWE-787 out-of-bounds write. Because the AV engine typically runs with elevated privileges (SYSTEM on Windows, root on macOS/Linux through a privileged daemon), a write primitive inside that process is a direct path to privileged code execution, not just a user-context crash.
RemediationAI
Upgrade the Avira Antivirus scan engine to build 8.3.27.12 or later on all Windows, macOS, and Linux endpoints; in most Avira deployments the engine updates automatically with definition updates, so verify that engine auto-update is enabled and confirm the installed engine version post-update via the product UI or management console. Track the vendor's specific bulletin under the Gen Digital advisories index (https://www.gendigital.com/us/en/contact-us/security-advisories/) for the formal patch reference. If immediate patching is blocked, compensating controls are limited because the scanner triggers automatically - options include disabling archive scanning for tar/POSIX-tar formats in policy (trade-off: malware inside tar archives will no longer be detected at write time, only on extraction), or blocking inbound tar attachments at the mail/web gateway (trade-off: legitimate tar deliveries to developers and Linux admins will be impacted). Do not disable the on-access scanner wholesale as a workaround, as that removes baseline endpoint protection.
More in Avira Antivirus
View allLocal code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Null pointer dereference in the Avira Antivirus scanning engine crashes the antivirus process when it parses a specially
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today