Avira Antivirus EUVD-2025-210122

Avira Antivirus engine build before 8.3.70.68 must be installed and actively scanning files - specifically, the PDF parser within the engine must process the malformed document, which in default deployments happens automatically via on-access scanning, scheduled scans, or manual right-click scans. The attacker needs a way to land the crafted PDF where the engine will read it (email attachment, web download, file share, removable media) but does not need credentials on the target host (PR:N). Exploitation is LIMITED by the CVSS UI:R requirement (the scanner must be triggered to read the file) and by AV:L (the file must reach local storage or a locally accessible path); pure network-borne exploitation without the file touching disk is not in scope. The bug affects Windows, macOS, and Linux builds equally since the engine is shared across platforms.

Signals are mixed and lean medium-priority rather than emergency. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is consistent with a file-scanning bug: the engine reaches the malicious PDF locally, no attacker authentication is needed, but user/automation interaction (placing the file where it gets scanned) is required. No EPSS, KEV, or SSVC data was provided in the input, and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The vendor's classification as an OOB read normally yields info-disclosure, yet the advisory text explicitly claims local code execution - a stronger outcome that should be treated cautiously until a vendor write-up or PoC details emerge. Anti-virus engines historically have a poor track record (similar bugs in Defender, ClamAV, Sophos have been exploitable), so realistic risk is non-trivial for any environment running an unpatched Avira engine on multi-tenant systems where untrusted users can drop files.

An attacker emails or drops a malformed PDF onto a system protected by an unpatched Avira engine (e.g., a download into a monitored folder, a USB stick auto-scanned on insert, or an email attachment scanned on receipt). When Avira's on-access scanner parses the PDF, the heap out-of-bounds read either crashes the engine (disabling AV protection) or, per the vendor's stated impact, enables local code execution in the privileged scanner process. No public exploit identified at time of analysis.