Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local delivery of malformed PE required (AV:L); no credentials needed but user must trigger scan (PR:N, UI:R); impact is AV process crash only (A:H, C:N, I:N).
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25031700.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a specially crafted malformed Windows PE file, causing a Denial-of-Service across five Gen Digital products - Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus - on Windows, macOS, and Linux. The vulnerability resides in the virus definition update stream rather than the product binary itself, meaning all five products sharing the same Gen Digital VPS stream are simultaneously exposed until updated to definition build VPS 25031700 or later. No public exploit code has been identified at time of analysis, and CVSS scores this at medium severity (5.5) reflecting local access and required user interaction as meaningful limiting factors.
Technical ContextAI
The root cause is CWE-674 (Uncontrolled Recursion): the PE file parser within the shared Gen Digital scanning engine enters recursive processing when it encounters a specially malformed PE structure, lacking a depth limit or recursion guard that would terminate the loop. Because the scanning logic is delivered via a shared virus definition update stream (VPS - Virus Protection Signatures), the flaw is architectural at the signature/engine layer rather than the product layer. This explains why five distinct products across three operating systems are simultaneously affected: cpe:2.3:a:gen_digital:avast_antivirus, cpe:2.3:a:gen_digital:avg_antivirus, cpe:2.3:a:gen_digital:norton_antivirus, cpe:2.3:a:gen_digital:avast_one, and cpe:2.3:a:gen_digital:avast_business_antivirus. The Windows PE (Portable Executable) format allows complex nested structures (e.g., resource directories, import tables) that a recursive parser can descend into indefinitely if the file is maliciously or accidentally malformed, ultimately exhausting the call stack and causing an unhandled exception or crash in the antivirus process.
RemediationAI
The primary fix is a virus definition update to VPS build 25031700 or later, delivered automatically through the standard Gen Digital definition update channel. Administrators should verify that all managed endpoints have received and applied VPS 25031700 or above - this can be confirmed through the AV management console's definition version reporting. For systems with automatic updates enabled and network connectivity, no manual intervention is required. For air-gapped or update-restricted environments, administrators should manually push VPS 25031700 or later from an offline update package obtained from the Gen Digital support portal (see https://www.gendigital.com/us/en/contact-us/security-advisories/). As a compensating control in environments where the definition update cannot be immediately applied, temporarily disabling real-time on-access scanning of PE files or restricting scanning of untrusted PE files from network shares reduces exposure, but note this also reduces malware detection capability during the window. There is no binary patch required - the fix is entirely in the definition build.
More from same product – last 7 days
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2025-210125
GHSA-w5xg-24x3-2465