CVE-2025-7008

Deferred Deferred - Pending Action

Heap Buffer Out-of-Bounds Read in Avast Antivirus

Publication date: 2026-06-12

Last updated on: 2026-06-15

Assigner: NortonLifeLock Inc.

Description

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-15

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-01

NVD

CVE-2025-7008

EUVD

EUVD-2025-210127

Affected Vendors & Products

Vendor	Product	Version / Range
avast	avast_antivirus	to 25021310 (exc)
avg	avg_antivirus	to 25021310 (exc)
norton	norton_antivirus	to 25021310 (exc)
avast	avast_one	to 25021310 (exc)
avast	avast_business_antivirus	to 25021310 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer out-of-bounds read issue found in Avast Antivirus products when scanning a malformed Windows PE file that contains .NET metadata.

It occurs during the scanning process and may allow an attacker to execute code locally or cause a denial-of-service (DoS) by crashing the antivirus process.

Impact Analysis

The vulnerability can impact you by allowing local execution of code, which means an attacker could potentially run malicious code on your system.

Alternatively, it could cause a denial-of-service condition by crashing the antivirus process, potentially leaving your system unprotected.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, or Avast Business Antivirus installations are updated to virus definition build VPS 25021310 or later.

Installations at or above this build are not vulnerable regardless of which product consumes the virus definition update stream.

Hi! I’m here to help you understand CVE-2025-7008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70