This vulnerability (CVE-2025-7011) involves a heap out-of-bounds read triggered by scanning a specially crafted zip file containing XML data in Avast Antivirus and related Gen Digital products. The affected products include Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux platforms. The root cause lies in the virus definition scanning engine shared across these products, delivered via a common update stream. Virus definition builds from 25020100 up to but not including 25021208 are vulnerable. The vulnerability can lead to local code execution or denial-of-service conditions. Mitigation is achieved by updating virus definitions to build 25021208 or later, which are not vulnerable.

Successful exploitation can result in local execution of arbitrary code or denial-of-service of the antivirus process. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). It requires local access with low attack complexity and no privileges but user interaction is required.

A fix is available through virus definition updates. Updating the virus definition build to 25021208 or later fully mitigates the vulnerability. Since the scanning engine is updated via the shared virus definition stream, ensuring the antivirus product is up to date with the latest virus definitions is the recommended remediation. No other specific mitigations are indicated.