This vulnerability (CVE-2025-7008) involves an out-of-bounds read on the heap triggered by scanning a malformed Windows PE file with .NET metadata in Gen Digital's Avast Antivirus and related products. The affected products include Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux platforms. The root cause is in the shared scanning engine delivered through a virus definition update stream. Virus definition builds before VPS 25021310 are vulnerable, while builds at or above this version have mitigations. The vulnerability can lead to local code execution or denial-of-service of the antivirus process. No known exploits in the wild have been reported. The CVSS v3.1 score is 7.8, indicating high severity with impact on confidentiality, integrity, and availability.

Successful exploitation may allow an attacker with local access to execute arbitrary code or cause a denial-of-service condition in the antivirus process. This could compromise the security of the affected system by bypassing antivirus protections or disrupting antivirus functionality. The impact affects confidentiality, integrity, and availability as reflected in the CVSS score.

The vulnerability is mitigated by updating virus definition builds to version VPS 25021310 or later. Installations at or above this build are not vulnerable regardless of the specific Gen Digital product used. No additional vendor advisory or patch information is provided, so users should ensure their virus definitions are current. Patch status is not explicitly confirmed beyond the virus definition update; check the vendor advisory for the latest remediation guidance.