CVE-2025-7008
Received Received - Intake
Heap Buffer Out-of-Bounds Read in Avast Antivirus

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: NortonLifeLock Inc.

Description
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-13
AI Q&A
2026-06-13
EPSS Evaluated
N/A
NVD
CVE-2025-7008
EUVD
EUVD-2025-210127
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
avast avast_antivirus to 25021310 (exc)
avg avg_antivirus to 25021310 (exc)
norton norton_antivirus to 25021310 (exc)
avast avast_one to 25021310 (exc)
avast avast_business_antivirus to 25021310 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer out-of-bounds read issue found in Avast Antivirus products when scanning a malformed Windows PE file that contains .NET metadata.

It occurs during the scanning process and may allow an attacker to execute code locally or cause a denial-of-service (DoS) by crashing the antivirus process.

Impact Analysis

The vulnerability can impact you by allowing local execution of code, which means an attacker could potentially run malicious code on your system.

Alternatively, it could cause a denial-of-service condition by crashing the antivirus process, potentially leaving your system unprotected.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, or Avast Business Antivirus installations are updated to virus definition build VPS 25021310 or later.

Installations at or above this build are not vulnerable regardless of which product consumes the virus definition update stream.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-7008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart