TI-2025-06377 Aliases CVE-2025-7010 GHSA-vf74-69rc-vmq4

Avast antivirus stack overflow when scanning a malformed PDF file

LOW 24CWE-674Published 2026-06-12 · Updated 2026-06-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021208. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00113 1st percentileScored 2026-11-07

Fix Fixed Avast Antivirus (Gen Digital): 25021208AVG Antivirus (Gen Digital): 25021208+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gen Digital	Avast Antivirus	before 25021208	25021208	Patch available	CNA
Gen Digital	AVG Antivirus	before 25021208	25021208	Patch available	CNA
Gen Digital	Norton Antivirus	before 25021208	25021208	Patch available	CNA
Gen Digital	Avast One	before 25021208	25021208	Patch available	CNA
Gen Digital	Avast Business Antivirus	before 25021208	25021208	Patch available	CNA

Avast Antivirus VendorGen Digital Affected before 25021208 Fixed in 25021208 Patch available CNA
AVG Antivirus VendorGen Digital Affected before 25021208 Fixed in 25021208 Patch available CNA
Norton Antivirus VendorGen Digital Affected before 25021208 Fixed in 25021208 Patch available CNA
Avast One VendorGen Digital Affected before 25021208 Fixed in 25021208 Patch available CNA
Avast Business Antivirus VendorGen Digital Affected before 25021208 Fixed in 25021208 Patch available CNA

Remediation

Fix · CNA Avast Antivirus (Gen Digital) Fixed in 25021208
Fix · CNA AVG Antivirus (Gen Digital) Fixed in 25021208
Fix · CNA Norton Antivirus (Gen Digital) Fixed in 25021208
Fix · CNA Avast One (Gen Digital) Fixed in 25021208
Fix · CNA Avast Business Antivirus (Gen Digital) Fixed in 25021208

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-12
Gen Digital AVG Antivirus, Avast Antivirus and 3 more products 25021208
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-06378 Avast antivirus heap OOB when scanning a malformed zip filePriority LOW 35
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-7010
2026-10-03 Alias added: GHSA-vf74-69rc-vmq4

References

Other 1

https://www.gendigital.com/us/en/contact-us/security-advisories/

TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3

See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences