This vulnerability (CVE-2025-14098) involves a heap buffer out-of-bounds write triggered by an integer overflow in the Avira Antivirus engine when processing malformed MS-DOS executable files. Successful exploitation may allow an attacker with local access to execute arbitrary code or cause a denial-of-service condition in the antivirus engine process. The issue affects Avira Antivirus engine builds prior to version 8.3.70.104 on Windows, macOS, and Linux platforms. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with local access can exploit this vulnerability by providing a specially crafted MS-DOS executable file to the Avira Antivirus engine, potentially leading to arbitrary code execution or crashing the antivirus engine process, resulting in denial-of-service. This compromises the security and stability of the affected system's antivirus protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid scanning untrusted or malformed MS-DOS executable files locally with affected versions of Avira Antivirus engine. Monitor vendor communications for updates.