EUVD-2025-210122
GHSA-xhrh-vvgh-pgxr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must reach local scan path (AV:L); no auth needed (PR:N) but scanner must process the file (UI:R); engine runs privileged, so successful LCE yields full C/I/A.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.
AnalysisAI
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compromise the scanning engine by placing a malformed PDF where the engine will scan it on Windows, macOS, or Linux. The flaw is a heap out-of-bounds read (CWE-125) triggered during PDF parsing, and no public exploit identified at time of analysis. CVSS is 7.8 (high) driven by full C/I/A impact on the local host, but exploitation requires user/scanner interaction with the malicious file.
Technical ContextAI
The defect lives inside the Avira Antivirus scanning engine - a cross-platform on-access/scheduled scanner that auto-parses untrusted file formats (here, PDF) to detect malware. CWE-125 (out-of-bounds read) in a heap region of the PDF parser means a crafted document with corrupted length fields, malformed object streams, or invalid cross-reference tables causes the parser to read past an allocated buffer. The CPE cpe:2.3:a:gen_digital:avira_antivirus:*:*:*:*:*:*:*:* indicates Gen Digital (the post-NortonLifeLock entity that owns Avira) ships a single engine codebase across Windows, macOS, and Linux, so the underlying parsing bug is platform-agnostic and the engine process runs with elevated privileges (SYSTEM/root) for on-access scanning, which is why an OOB read in a security product is rated for local code execution rather than just an information leak.
RemediationAI
Update the Avira Antivirus scanning engine to build 8.3.70.68 or later, which the vendor identifies as the fix line - Patch available per vendor advisory at https://www.gendigital.com/us/en/contact-us/security-advisories/. Engine updates are normally delivered automatically through Avira's update channel, so verify that auto-update is enabled and force a manual definition/engine update; on managed endpoints confirm the engine build (not just the product version) reports 8.3.70.68+. If patching is delayed, compensating controls include disabling on-access scanning of PDFs (trade-off: reduces malware detection coverage for the most common phishing payload), routing inbound PDFs through a separate sandbox or upstream gateway scanner instead of Avira, and restricting which users can drop files into directories monitored by the on-access scanner - none of these are a substitute for the engine update and each materially weakens AV coverage while in place.
More from same product – last 7 days
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Share
External POC / Exploit Code
Leaving vuln.today