This vulnerability (CVE-2025-9032) involves a heap buffer out-of-bounds read in the Avira Antivirus engine triggered by scanning a malformed Windows PE file. Successful exploitation could lead to local code execution or denial-of-service against the antivirus engine process. The issue affects Avira Antivirus engine builds prior to 8.3.70.98 on Windows, macOS, and Linux. The CVSS 3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

An attacker with local access could exploit this vulnerability to execute arbitrary code with the privileges of the antivirus engine or cause the antivirus process to crash, resulting in denial-of-service. This compromises system security by potentially bypassing antivirus protections or disrupting antivirus operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid scanning untrusted or malformed Windows PE files locally and monitor for updates from Gen Digital regarding patches or workarounds.