The vulnerability identified as CVE-2025-9033 involves a heap buffer out-of-bounds read in the Avira Antivirus engine triggered by scanning specially crafted malformed PDF files. This can cause memory corruption that may allow an attacker with local access to execute arbitrary code or cause a denial-of-service by crashing the antivirus engine process. The issue affects all Avira Antivirus engine builds prior to 8.3.70.76 on Windows, macOS, and Linux. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. As of the published date, no official fix or patch has been announced.

Exploitation of this vulnerability can lead to local execution of arbitrary code or denial-of-service of the antivirus engine process. This impacts the confidentiality, integrity, and availability of the affected system's security software, potentially undermining the protection provided by Avira Antivirus.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening PDF files from untrusted sources and consider disabling automatic scanning of PDF files if possible.