This vulnerability (CVE-2025-9032) involves a heap buffer out-of-bounds read in the Avira Antivirus engine triggered by scanning a specially crafted Windows PE file. The flaw can lead to local code execution or denial-of-service impacting confidentiality, integrity, and availability of the antivirus process. It affects Avira Antivirus engine builds prior to 8.3.70.98 on Windows, macOS, and Linux. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation may allow a local attacker to execute arbitrary code with the privileges of the antivirus engine or cause the antivirus process to crash, resulting in denial-of-service. This impacts the confidentiality, integrity, and availability of the affected system's antivirus protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid scanning untrusted or malformed Windows PE files locally with affected versions of Avira Antivirus engine builds prior to 8.3.70.98.