CVE-2025-7008 Details
Description
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
A heap buffer out-of-bounds read vulnerability has been identified in Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. This vulnerability occurs when the software scans a malformed Windows PE file containing .NET metadata, potentially allowing local execution of code or causing a denial-of-service condition in the antivirus process. The issue affects multiple platforms, including Windows, macOS, and Linux, and is present in virus definition builds prior to VPS 25021310. The vulnerable scanning logic is distributed through a shared Gen Digital virus definition update stream, which also services other Gen Digital products that embed the same engine. Installations at or above the listed build are not vulnerable, regardless of the product.
Users can update their antivirus software to the latest version or ensure that their virus definitions are updated to VPS 25021310 or later to mitigate this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.gendigital.com/us/en/contact-us/security-advisories/ | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Avast Antivirus | < VPS 25021310 |
CPE
Remediation
| |
| AVG Antivirus | < VPS 25021310 |
CPE
Remediation
| |
| Norton Antivirus | < VPS 25021310 |
CPE
Remediation
| |
| Avast One | < VPS 25021310 |
CPE
Remediation
| |
| Avast Business Antivirus | < VPS 25021310 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |