Avira Antivirus EUVD-2025-210135

Requires the Avira Antivirus engine (build older than 8.3.70.76) to scan an attacker-supplied malformed PDF on the target host - meaning the attacker must place the PDF where Avira's on-access scanner, scheduled scan, or a user-initiated scan will process it (email attachment cached to disk, downloaded file, USB media, file share). Limiting factors: the CVSS vector requires UI:R (user interaction, e.g., user downloads or opens the file causing on-access scan), and AV:L means the attacker cannot trigger this purely over the network without first landing the file locally; the bug is a read primitive (CWE-125), so escalation from over-read to actual code execution likely requires further exploitation work beyond just delivering the malformed file.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H rates impact as high across all three pillars but explicitly requires local attack vector and user interaction, which is consistent with the described scenario of the engine scanning a file delivered to the host. There is no EPSS score, KEV listing, or public POC provided, so real-world exploitation pressure appears low at present; the bug is a read primitive (CWE-125), and achieving code execution from a heap over-read typically requires additional primitives, making the 'Local Execution of Code' outcome plausible but not trivially guaranteed. A notable inconsistency: the vector marks C:H/I:H/A:H and the vendor describes code execution, yet CWE-125 alone is usually a disclosure/DoS primitive - the integrity/code-execution rating should be treated as vendor-asserted rather than independently confirmed.

An attacker emails or hosts a malformed PDF and induces a user to download or open it on a host running a vulnerable Avira engine; Avira's on-access scanner automatically parses the file, hits the out-of-bounds read in the PDF parser, and either crashes the engine (leaving the host temporarily unprotected) or, per vendor assertion, achieves local code execution in the privileged AV process. No public exploit identified at time of analysis, so practical exploitation would require an attacker to develop a working primitive against the proprietary parser.