EUVD-2025-210131
GHSA-gj87-8w35-2w23
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be scanned (AV:L, UI:R); no auth needed to plant a file (PR:N); privileged AV engine execution yields full C/I/A impact within the same scope.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.
AnalysisAI
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner parses a malformed Windows MSI installer file, triggering a heap out-of-bounds read. The flaw affects deployments on Windows, macOS, and Linux and requires user interaction to place a crafted MSI where the engine will scan it. No public exploit identified at time of analysis and CVSS scores it 7.8 High.
Technical ContextAI
The vulnerability is a CWE-125 out-of-bounds read in the Avira Antivirus scanning engine, identified in CPE cpe:2.3:a:gen_digital:avira_antivirus (Gen Digital, the vendor that absorbed Avira). MSI files are Microsoft Installer packages built on the OLE/Compound File Binary structured-storage format, which contains tables and streams parsed by AV engines to inspect embedded executables. A malformed MSI can cause the parser to read past an allocated heap buffer, exposing adjacent memory or - depending on how the read value is later used - corrupting control flow inside the always-on scanning service.
RemediationAI
Patch available per vendor advisory: update the Avira Antivirus scanning engine to build 8.3.70.56 or later, which most Avira products receive automatically through the engine/definition update channel - verify the engine build under Avira's About/Update screen and consult https://www.gendigital.com/us/en/contact-us/security-advisories/ for the formal notice. Until the updated engine is confirmed deployed, compensating controls include disabling on-access scanning of MSI files via exclusion of the .msi extension (trade-off: malicious installers will no longer be inspected pre-execution, weakening endpoint protection) or blocking inbound delivery of MSI attachments at the mail gateway and proxy (trade-off: legitimate software deployments delivered via MSI may be interrupted). Endpoint logging should be increased on the Avira service process so that crashes consistent with this CWE-125 read are surfaced rather than silently restarted.
More from same product – last 7 days
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Share
External POC / Exploit Code
Leaving vuln.today