This vulnerability (CVE-2025-7010) involves uncontrolled recursion in the scanning logic of Gen Digital's antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. The flaw can cause a stack overflow when processing a specially crafted malformed PDF file, resulting in denial-of-service of the antivirus process. The affected scanning engine is delivered via a shared virus definition update stream. Virus definition builds before VPS 25021208 are vulnerable, while builds at or above this version have mitigations applied. The vulnerability affects Windows, macOS, and Linux versions of these products.

Successful exploitation can cause the antivirus process to crash due to stack overflow, resulting in denial-of-service. There is no indication of confidentiality or integrity impact. The vulnerability requires local access to trigger scanning of a malformed PDF file. No known exploits are reported in the wild.

A fix is available through virus definition updates. Systems running virus definition builds at or above VPS 25021208 are not vulnerable. Users should ensure their antivirus products are updated to use virus definitions version VPS 25021208 or later. No additional mitigation steps are indicated.