CVE-2025-7006 Details
Description
Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25022500. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
A stack memory use-after-free vulnerability has been identified in Gen Digital antivirus products, including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. This vulnerability affects Windows, macOS, and Linux systems with virus definition builds prior to VPS 25022500. The issue arises when the antivirus scans a malformed Windows PE file, potentially leading to a denial-of-service condition for the antivirus process. The vulnerable scanning logic is distributed through a shared Gen Digital virus definition update stream, which also services other Gen Digital products that embed the same engine. Installations at or above the listed build are not vulnerable, regardless of the product.
Users can update their antivirus products to version VPS 25022500 or later to mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.gendigital.com/us/en/contact-us/security-advisories/ | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-590 | Free of Memory not on the Heap | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Avast Antivirus | < VPS 25022500 |
CPE
Remediation
| |
| AVG Antivirus | < VPS 25022500 |
CPE
Remediation
| |
| Norton Antivirus | < VPS 25022500 |
CPE
Remediation
| |
| Avast One | < VPS 25022500 |
CPE
Remediation
| |
| Avast Business Antivirus | < VPS 25022500 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |