This vulnerability (CVE-2025-14098) involves a heap buffer out-of-bounds write due to an integer overflow in the Avira Antivirus scanning engine. The issue occurs when the engine processes a specially crafted malformed MS-DOS executable file. Successful exploitation can lead to local code execution or denial-of-service against the antivirus engine process. The affected product is Avira Antivirus on Windows, macOS, and Linux platforms with engine versions prior to 8.3.70.104. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows a local attacker to potentially execute arbitrary code with the privileges of the antivirus engine or cause a denial-of-service by crashing the antivirus process. This could undermine the security posture of the affected system by disabling antivirus protection or enabling code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when scanning untrusted or malformed MS-DOS executable files and consider limiting local access to the antivirus engine where feasible.