This vulnerability involves uncontrolled recursion in the scanning logic of Gen Digital's antivirus engine when processing a malformed Windows PE file. The affected scanning engine is shared across several Gen Digital antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on multiple operating systems. The vulnerability can lead to a denial-of-service (DoS) by causing the antivirus process to crash or hang. The virus definition update stream delivering the scanning logic is the vector for mitigation; virus definition builds at or above VPS 25031700 contain the fix. No direct patch for the antivirus software itself is indicated, as the fix is distributed through updated virus definitions.

Successful exploitation results in denial-of-service of the antivirus process, potentially reducing endpoint protection availability. There is no impact on confidentiality or integrity of data. The vulnerability requires local access with low complexity and user interaction. The attack vector is local, and privileges are not required, but user interaction is necessary to trigger the scan of a malformed file.

Update virus definitions to build VPS 25031700 or later to remediate this vulnerability. All installations at or above this virus definition build are not vulnerable. No additional action is required beyond ensuring virus definitions are current. Since the fix is delivered via the virus definition update stream, maintaining up-to-date definitions is the primary mitigation.