This vulnerability involves uncontrolled recursion in the scanning logic of Avast Antivirus and related Gen Digital products when processing malformed Windows PE files. The affected products share a common virus definition update stream, and the vulnerability exists in virus definition builds before VPS 25031700. Successful exploitation may cause the antivirus process to crash or become unresponsive, resulting in a denial-of-service condition. The vulnerability does not impact confidentiality or integrity, only availability. No official remediation level or patch link is provided, but the vendor indicates that installations at or above virus definition build VPS 25031700 are not vulnerable.

The vulnerability can cause a denial-of-service condition by crashing or hanging the antivirus scanning process when it encounters a specially crafted malformed Windows PE file. There is no impact on confidentiality or integrity. This may reduce the effectiveness of the antivirus protection temporarily but does not lead to code execution or data compromise. No known exploits have been reported in the wild.

The vendor mitigates this vulnerability through virus definition updates. Versions of the virus definitions at or above VPS 25031700 are not vulnerable. Users should ensure their antivirus products are updated to use virus definition builds VPS 25031700 or later. No additional action is required beyond updating virus definitions. Patch status is not explicitly confirmed beyond this update; check the vendor advisory for current remediation guidance.