This vulnerability (CVE-2025-7009) involves a heap buffer out-of-bounds read in the scanning engine of Gen Digital antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux platforms. The issue occurs when scanning a malformed Windows PE file, potentially leading to local code execution or denial-of-service conditions. The affected scanning logic is delivered through a shared virus definition update stream. Virus definition builds before VPS 25021310 are vulnerable, while builds at or above this version have mitigations applied via the update channel.

Successful exploitation can lead to local execution of code or denial-of-service of the antivirus process, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction (UI:R) to trigger. The CVSS 3.1 base score is 7.8 (high severity), reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no privileges required.

A fix is available through virus definition updates. Systems with virus definition builds at or above VPS 25021310 are not vulnerable. Users should ensure their antivirus products are updated to at least this virus definition build to mitigate the vulnerability. Since the scanning logic is updated via the virus definition stream, applying these updates is the primary remediation step.