TI-2025-09985 Aliases CVE-2025-10905 GHSA-7rvm-5hwf-93cv

Collision in minifilter driver of Avast Free Antivirus results in disabling of real-time protection

LOW 19CWE-693Published 2025-11-11 · Updated 2025-11-12

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00127 2nd percentileScored 2026-11-07

Fix Fixed Free Antivirus (Avast): 25.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Avast	Free Antivirus	before 25.9	25.9	Patch available	CNA

Free Antivirus VendorAvast Affected before 25.9 Fixed in 25.9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:avast:free_antivirus::::::::	—	—	Avast

cpe:2.3:a:avast:free_antivirus:*:*:*:*:*:*:*:* Versions — — ·Avast

Remediation

Fix · CNA Free Antivirus (Avast) Fixed in 25.9

Timeline

2026-10-02 Threatist record created from CVE-2025-10905
2026-10-03 Alias added: GHSA-7rvm-5hwf-93cv

References

Other 1

https://www.gendigital.com/us/en/contact-us/security-advisories/)

TI-2025-43447 AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation CVSS 4.0HIGH 8.5
TI-2020-19172 AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2010-02987 Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier… CVSS 2.0HIGH 9.3
TI-2007-02752 Heap-based buffer overflow in the CAB unpacker in avast! Anti-Virus Managed Client before… CVSS 2.0HIGH 9.3
TI-2020-14724 An issue was discovered in retdec v3.3. CVSS 3.1CRITICAL 9.8
TI-2020-08753 An issue was discovered in Avast Antivirus before 20. CVSS 3.1CRITICAL 9.8

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences