This vulnerability (CVE-2025-7008) involves a heap buffer out-of-bounds read triggered by scanning malformed Windows PE files containing .NET metadata. It affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux platforms when using virus definition builds before VPS 25021310. The issue stems from the shared Gen Digital virus definition update stream that delivers the vulnerable scanning logic. Exploitation could lead to local code execution or denial-of-service of the antivirus process. The vulnerability is mitigated by updating virus definitions to build VPS 25021310 or later.

Successful exploitation can result in local execution of arbitrary code or denial-of-service conditions affecting the antivirus process. This impacts confidentiality, integrity, and availability of the affected systems. The vulnerability requires local access and user interaction (UI:R) and has low attack complexity. The CVSS 3.1 base score is 7.8 (high severity).

A fix is available by updating the virus definition build to VPS 25021310 or later. Installations at or above this build are not vulnerable. Since the scanning logic is delivered via a shared virus definition update stream, ensuring the antivirus product is updated to use the latest definitions effectively mitigates the issue. No additional mitigation steps are indicated.