EUVD-2026-36631
GHSA-c89p-wq36-89h3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed POSIX tar archive
-
DeliveryDeliver via email/web/USB to target
-
ExploitFile written to disk triggers on-access scan
-
ExecutionHeap OOB write in engine parser
-
PersistHijack control flow in privileged AV process
-
ImpactExecute code as SYSTEM/root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target endpoint must be running an Avira Antivirus engine build earlier than 8.3.27.12 with archive scanning enabled (the default) on Windows, macOS, or Linux. Exploitation requires the attacker to deliver a malformed POSIX tar (.tar / ustar) archive to a location the scanner will inspect - on-access scan of a downloaded/received file, scheduled scan, or an explicit user-initiated scan; the CVSS UI:R reflects that the file must reach the scanner, not that the user must double-click it. No authentication to the host is required, and no network listener is involved - the attack vector is local because the malicious file must reside on (or be mounted to) the local filesystem the engine scans. Endpoints where archive scanning has been explicitly disabled, or where the engine has already auto-updated to 8.3.27.12+, are not exploitable. |
| Impact | CVSS 7.8 with AV:L/AC:L/PR:N/UI:R reflects local attack vector with required user interaction, but in AV scanners 'user interaction' is unusually cheap - the user merely has to receive a file (email attachment, download, USB) which the on-access scanner then opens automatically, effectively converting UI:R into passive triggering. C:H/I:H/A:H is consistent with code execution inside a privileged engine process. There is no EPSS, KEV, or SSVC data supplied, and no public POC is referenced, so quantitative exploitation likelihood is unknown; the only reference is the vendor advisory portal root, not a specific advisory page, which limits independent verification. Net: the CVSS-implied severity is credible given AV engines run as SYSTEM/root, but absence of KEV/EPSS data means prioritization should be driven by the privileged-process exposure rather than confirmed exploitation telemetry. |
| Exploit ScenarioDerived | An attacker emails a malformed POSIX tar archive to a target, or hosts it on a watering-hole site; when the file lands on disk, Avira's on-access scanner automatically parses it and triggers the heap out-of-bounds write inside the privileged engine process. Successful exploitation yields code execution as SYSTEM (Windows) or root (macOS/Linux), and at minimum an unsuccessful corruption crashes the engine, leaving the endpoint unprotected. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Local code execution in Avira Antivirus engine builds prior to 8.3.27.12 on Windows, macOS, and Linux occurs when the scanner parses a malformed POSIX tar archive, triggering a heap out-of-bounds write that can either crash the AV process (DoS) or execute attacker code in the scanner's context. No public exploit identified at time of analysis, but the on-access scanning model means a victim only has to write the malicious tar to disk for the engine to touch it. Reported by GEN (Gen Digital, Avira's parent).
RemediationAI
Upgrade the Avira Antivirus scan engine to build 8.3.27.12 or later on all Windows, macOS, and Linux endpoints; in most Avira deployments the engine updates automatically with definition updates, so verify that engine auto-update is enabled and confirm the installed engine version post-update via the product UI or management console. Track the vendor's specific bulletin under the Gen Digital advisories index (https://www.gendigital.com/us/en/contact-us/security-advisories/) for the formal patch reference. If immediate patching is blocked, compensating controls are limited because the scanner triggers automatically - options include disabling archive scanning for tar/POSIX-tar formats in policy (trade-off: malware inside tar archives will no longer be detected at write time, only on extraction), or blocking inbound tar attachments at the mail/web gateway (trade-off: legitimate tar deliveries to developers and Linux admins will be impacted). Do not disable the on-access scanner wholesale as a workaround, as that removes baseline endpoint protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in Avira's archive-unpacking layer used by the scan engine across all three desktop OS builds (per the cross-platform CPE cpe:2.3:a:gen_digital:avira_antivirus:*). POSIX tar (ustar) headers carry octal-encoded size and offset fields plus extended PAX records; mishandling these length fields when copying file or header data into a heap allocation produces the classic CWE-787 out-of-bounds write. Because the AV engine typically runs with elevated privileges (SYSTEM on Windows, root on macOS/Linux through a privileged daemon), a write primitive inside that process is a direct path to privileged code execution, not just a user-context crash.
Know when Avira Antivirus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local because the tar must reach the scanner's filesystem; UI:R since a file must be received; PR:N as the scanner auto-parses; C/I/A:H from code execution in privileged engine.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
2DescriptionCVE.org
Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.
This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.
Executive ViewAI
Avira Antivirus engine versions below 8.3.27.12 contain a local code execution vulnerability that turns the security tool itself into an attack vector on Windows, macOS, and Linux endpoints. Attackers need only place a malformed tar archive on disk for the antivirus process to execute arbitrary code with the privileges of the AV engine, potentially enabling lateral movement, data exfiltration, or credential theft. No patch is currently available, eliminating the standard remediation path and forcing organizations into difficult operational trade-offs between eliminating the vulnerability and maintaining antivirus protection.
No vendor-released patch identified at time of analysis. Interim mitigations: disable on-access scanning where operationally feasible and supplemented by offline scanning; restrict write permissions in common file-drop locations (Downloads, Temp directories) to trusted processes; enforce application whitelisting to prevent code execution in the antivirus process context; implement endpoint detection and response (EDR) to monitor antivirus process behavior for anomalies; isolate high-value systems and restrict tar file creation until patch is available; maintain air-gapped backups to enable rapid system rebuild if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Avira Antivirus
View allLocal code execution in Avira Antivirus engine builds before 8.3.70.104 on Windows, macOS, and Linux allows attackers to
Local code execution in Avira Antivirus engine builds before 8.3.70.76 on Windows, macOS, and Linux is triggered when th
Heap out-of-bounds read in the Avira Antivirus scanning engine on Windows, macOS, and Linux (engine builds before 8.3.70
Local code execution or denial-of-service in Avira Antivirus engine builds prior to 8.3.70.56 occurs when the scanner pa
Out-of-bounds heap read in the Avira Antivirus scanning engine triggers when the engine parses a malformed PDF, allowing
Local code execution and denial-of-service in Avira Antivirus engine builds before 8.3.70.68 allow an attacker to compro
Null pointer dereference in the Avira Antivirus scanning engine crashes the antivirus process when it parses a specially
Exploit-DB