EUVD-2025-210136
GHSA-575m-c8qr-pcg3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file must reach the host (AV:L) and be scanned via user/system action (UI:R); no AV auth needed (PR:N); engine runs with high privilege so successful OOB write yields full C/I/A impact.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.
AnalysisAI
Local code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to trigger a heap buffer out-of-bounds write by having the engine scan a malformed MS-DOS executable. The flaw stems from an integer overflow during parsing and can also crash the antivirus engine process, with no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in Avira's scanning engine (cpe:2.3:a:gen_digital:avira_antivirus), specifically the parser that processes MS-DOS executable (MZ) headers. An integer overflow occurs while computing a size or offset value from attacker-controlled fields in a crafted MZ binary, producing a smaller-than-expected heap allocation or wrap-around index that is subsequently used in a copy operation. This is a classic CWE-787 out-of-bounds write on the heap, where corrupted adjacent metadata (chunk headers, function pointers, vtables in the scan engine process) can be leveraged for control-flow hijack on Windows, macOS, and Linux engine builds prior to 8.3.70.104.
RemediationAI
Vendor-released patch: Avira Antivirus engine build 8.3.70.104 or later - update the antivirus engine on all Windows, macOS, and Linux endpoints via the standard Avira/Gen Digital update channel and verify the engine version post-update, since product UI versions differ from engine builds. Refer to the Gen Digital security advisories page at https://www.gendigital.com/us/en/contact-us/security-advisories/ for the formal bulletin. As a temporary compensating control where immediate update is not possible, restrict the AV from scanning untrusted/quarantine directories containing unvetted MZ executables or disable on-access scanning of legacy MS-DOS executables; note this materially weakens malware coverage and should only bridge the time until the engine update propagates.
More from same product – last 7 days
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Share
External POC / Exploit Code
Leaving vuln.today