EUVD-2025-210127
GHSA-9p39-jvf2-cmhf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be scanned (AV:L, UI:R), no auth needed (PR:N); OOB read reliably crashes AV (A:H) while RCE/info-leak from a read primitive is uncertain, so C:L/I:L rather than H.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) allows a malformed Windows PE file with crafted .NET metadata to crash the AV process or potentially execute code locally on Windows, macOS, and Linux endpoints running virus definitions prior to VPS 25021310. No public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the bug is reachable via on-access scanning, meaning any user who receives a malicious file may trigger it without explicit action. UI:R in the CVSS vector and the local attack vector temper the urgency relative to the 7.8 base score.
Technical ContextAI
The flaw is a CWE-125 out-of-bounds read in the PE/.NET parser embedded in the shared Gen Digital virus definition update stream - the same engine code path consumed by Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus, as confirmed by the five gen_digital CPEs in NVD. PE files carry an optional COM/CLR header pointing at .NET metadata tables (#~, #Strings, #US, #GUID, #Blob); insufficient bounds checking when walking these structures lets a crafted file steer the scanner into reading past the allocated heap buffer. Because AV engines auto-scan files written to disk or arriving via email/web, the parser sits behind a privileged, always-on attack surface running with elevated rights on every supported OS.
RemediationAI
Patch available per vendor advisory - ensure each affected installation has pulled VPS definition build 25021310 or later via the standard Gen Digital virus definition update channel, which is shared across Avast, AVG, Norton, Avast One, and Avast Business Antivirus; no installer upgrade is required because mitigation ships through definitions rather than the product binary. Verify on endpoints by checking the VPS/definitions build number in the product UI or via management console reporting, and force an update on any host whose auto-update is disabled or stale. If updates cannot be applied immediately, the only meaningful compensating control is to disable on-access (real-time) scanning of untrusted file sources such as email attachments and downloads to prevent the parser from touching attacker-supplied PE files - this materially reduces malware detection coverage and should be a short-window measure only, not a long-term workaround; do not rely on file-extension or MIME filtering since PE parsing is triggered by content. Confirm advisory details at https://www.gendigital.com/us/en/contact-us/security-advisories/.
More in Norton Antivirus
View allInteger overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); S
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec
Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Busine
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection S
Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection S
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today