CVE-2025-7009 Details

A heap buffer out-of-bounds read vulnerability has been identified in Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. This vulnerability occurs when the software scans a malformed Windows PE file, potentially allowing local execution of code or causing a denial-of-service condition in the antivirus process. The issue affects multiple platforms, including Windows, macOS, and Linux, and is present in virus definition builds prior to VPS 25021310. The vulnerable scanning logic is distributed through a shared Gen Digital virus definition update stream, which also impacts other Gen Digital products that use the same engine. Installations at or above the listed build are not vulnerable, regardless of the product.

Users can update their antivirus software to version VPS 25021310 or later to mitigate this vulnerability. Instructions for updating can be found on the official websites of the respective antivirus products.