CVE-2025-7019 is a stack-based buffer overflow vulnerability (CWE-121) in the scanning logic of Gen Digital's Avast Antivirus and related products. The vulnerability is triggered by scanning a malformed Office Open XML file, potentially causing the antivirus process to crash and resulting in a denial-of-service (DoS). The affected scanning logic is delivered via a shared virus definition update stream used by multiple Gen Digital antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux. The vulnerability is mitigated by virus definition updates at or above build VPS 25020100, which prevent exploitation regardless of the consuming product.

Successful exploitation results in denial-of-service of the antivirus process, impacting availability. There is no confidentiality or integrity impact reported. The vulnerability requires local access (AV:L) and user interaction (UI:R) to trigger. No known exploits are reported in the wild.

The vulnerability is mitigated by updating virus definitions to build VPS 25020100 or later. Installations at or above this virus definition build are not vulnerable. No additional action is required beyond ensuring virus definitions are current. There is no official patch for the antivirus software itself since the fix is delivered through the virus definition update stream.