This vulnerability (CVE-2025-7002) involves a heap buffer out-of-bounds read in the Avira Antivirus engine triggered by scanning a malformed PDF file. Successful exploitation could lead to local code execution or denial-of-service impacting confidentiality, integrity, and availability. The issue affects Avira Antivirus engine builds prior to 8.3.70.68 on Windows, macOS, and Linux. No vendor advisory or patch information is available at this time, and no known exploits are reported in the wild.

Exploitation of this vulnerability can result in local attackers executing arbitrary code or causing a denial-of-service condition in the antivirus engine process. This impacts the confidentiality, integrity, and availability of the affected system. The attack vector is local with low attack complexity and no privileges required, but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid scanning untrusted or malformed PDF files locally with affected versions of Avira Antivirus engine. Monitor vendor communications for updates.