This vulnerability (CVE-2025-7004) involves a heap buffer out-of-bounds write in the scanning logic of Gen Digital's antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux platforms. The issue occurs when scanning a malformed Windows PE file, potentially enabling local attackers to execute code or cause a denial-of-service condition in the antivirus process. The affected scanning engine is delivered through a shared virus definition update stream. Virus definition builds before VPS 25040308 are vulnerable; builds at or above this version mitigate the issue.

Successful exploitation can lead to local code execution or denial-of-service of the antivirus process, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction (UI required). The CVSS 3.1 base score is 7.8 (high severity), reflecting the potential for significant impact if exploited.

A fix is available through virus definition updates. Systems with virus definition builds at or above VPS 25040308 are not vulnerable. Users should ensure their antivirus products are updated to at least this virus definition build to mitigate the vulnerability. No additional vendor advisory or patch details are provided, so users should verify update status via official Gen Digital update channels.