This vulnerability (CVE-2025-7010) involves uncontrolled recursion in the virus scanning engine used by Gen Digital's Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. When these products scan a malformed PDF file, the recursion can lead to a stack overflow, resulting in a denial-of-service condition by terminating the antivirus process. The affected scanning logic is delivered via a shared virus definition update stream. Virus definition builds before VPS 25021208 are vulnerable, while builds at or above VPS 25021208 have mitigations applied. The vulnerability impacts multiple operating systems including Windows, macOS, and Linux. No known exploits are reported in the wild.

Successful exploitation causes denial-of-service by crashing the antivirus process due to stack overflow from uncontrolled recursion. There is no impact on confidentiality or integrity. The availability of the antivirus process is affected, potentially reducing endpoint protection until the antivirus is restarted or updated.

Updating virus definitions to version VPS 25021208 or later mitigates this vulnerability. Since the scanning engine is updated through the virus definition stream, maintaining up-to-date virus definitions ensures protection. No additional patches or fixes are indicated beyond updating virus definitions. Users should verify their antivirus virus definition build version and update if it is prior to VPS 25021208.