TI-2025-06386 Aliases CVE-2025-7019 GHSA-5rmp-977f-x986

Avast antivirus stack overflow when scanning a malformed Office Open XML file

LOW 24CWE-121Published 2026-06-12 · Updated 2026-06-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00113 1st percentileScored 2026-11-07

Fix Fixed Avast Antivirus (Gen Digital): 25020100AVG Antivirus (Gen Digital): 25020100+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gen Digital	Avast Antivirus	before 25020100	25020100	Patch available	CNA
Gen Digital	AVG Antivirus	before 25020100	25020100	Patch available	CNA
Gen Digital	Norton Antivirus	before 25020100	25020100	Patch available	CNA
Gen Digital	Avast One	before 25020100	25020100	Patch available	CNA
Gen Digital	Avast Business Antivirus	before 25020100	25020100	Patch available	CNA

Avast Antivirus VendorGen Digital Affected before 25020100 Fixed in 25020100 Patch available CNA
AVG Antivirus VendorGen Digital Affected before 25020100 Fixed in 25020100 Patch available CNA
Norton Antivirus VendorGen Digital Affected before 25020100 Fixed in 25020100 Patch available CNA
Avast One VendorGen Digital Affected before 25020100 Fixed in 25020100 Patch available CNA
Avast Business Antivirus VendorGen Digital Affected before 25020100 Fixed in 25020100 Patch available CNA

Remediation

Fix · CNA Avast Antivirus (Gen Digital) Fixed in 25020100
Fix · CNA AVG Antivirus (Gen Digital) Fixed in 25020100
Fix · CNA Norton Antivirus (Gen Digital) Fixed in 25020100
Fix · CNA Avast One (Gen Digital) Fixed in 25020100
Fix · CNA Avast Business Antivirus (Gen Digital) Fixed in 25020100

Timeline

2026-10-02 Threatist record created from CVE-2025-7019
2026-10-03 Alias added: GHSA-5rmp-977f-x986

References

Other 1

https://www.gendigital.com/us/en/contact-us/security-advisories/

TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3

See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences