Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malformed file must reach local scanner (AV:L, UI:R); no auth needed (PR:N); AV process typically privileged so successful code execution yields high C/I/A.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process.
This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208.
The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
AnalysisAI
Local code execution and denial-of-service in Gen Digital antivirus engines (Avast, AVG, Norton, Avast One, Avast Business Antivirus) on Windows, macOS, and Linux stems from a heap out-of-bounds read in the malformed-ZIP/XML scanner across virus definition builds 25020100 through 25021207. An attacker who lures a user into letting the on-access scanner process a crafted archive can crash the antivirus process or potentially execute code in its context. No public exploit identified at time of analysis and the EPSS signal was not provided.
Technical ContextAI
The defect is a CWE-125 out-of-bounds read on the heap inside the archive-scanning component shared by Gen Digital's consumer and business antivirus engines. The vulnerable code path is triggered when the scanner unpacks a ZIP file and parses XML content within it, suggesting a length or bounds miscalculation while traversing structured records in the embedded document. Because the affected logic ships through the centralized Gen Digital virus definition update stream rather than the product installer, every product that consumes the stream - Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus per the CPE list - is uniformly affected and uniformly fixed when the definition build advances.
RemediationAI
Patch available per vendor advisory: ensure the virus definition build is at or above 25021208, which is delivered automatically through the Gen Digital definition update stream consumed by Avast, AVG, Norton, Avast One, and Avast Business Antivirus - administrators should verify the engine has successfully pulled an update past that build via the product's update status UI or management console. Because the fix ships through definitions rather than installer packages, no product reinstallation or version upgrade is required, but environments that block or stale-cache definition updates (air-gapped endpoints, restrictive proxies, paused updates) must release those constraints. As a temporary compensating control before the definition update applies, restrict the scanner's exposure to attacker-supplied archives by blocking inbound ZIPs at email and web gateways and disabling automatic scanning of removable media, accepting the trade-off that legitimate archive-borne malware will not be caught by on-access scanning during the window. Refer to https://www.gendigital.com/us/en/contact-us/security-advisories/ for the authoritative advisory.
More from same product – last 7 days
Heap out-of-bounds write in Gen Digital's shared antivirus scanning engine allows local code execution or denial of serv
Out-of-bounds heap read in the Gen Digital antivirus scanning engine (Avast, AVG, Norton, Avast One, Avast Business) all
Local code execution or antivirus-process denial-of-service in Gen Digital's shared scanning engine (Avast Antivirus, AV
Uncontrolled recursion in the Gen Digital shared scanning engine crashes the antivirus process when it encounters a spec
Stack use-after-free in the Gen Digital shared antivirus scanning engine crashes the antivirus process when it parses a
Share
External POC / Exploit Code
Leaving vuln.today
EUVD-2025-210130
GHSA-j95q-6549-w3j4