This vulnerability involves a heap buffer out-of-bounds read in the scanning logic of Avast Antivirus and related Gen Digital products triggered by malformed Mach-O files. The affected scanning engine is delivered via a shared virus definition update stream common to Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across multiple platforms. The issue allows local attackers to cause code execution or denial-of-service conditions in the antivirus process. The vulnerability is mitigated by updating virus definitions to build VPS 25090300 or later, which contain the fix.

Successful exploitation can lead to local execution of arbitrary code or denial-of-service of the antivirus process, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction (UI required). The CVSS 3.1 base score is 7.8 (high severity), reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no privileges required.

Users should ensure their virus definitions are updated to build VPS 25090300 or later. This update contains the fix for the vulnerability. No additional action is required if virus definitions are current. Since the vulnerability is mitigated through the virus definition update stream, maintaining up-to-date definitions is the primary remediation.