CVE-2025-7004: Heap Buffer Overflow in Avast, AVG, Norton Antivirus – Gen Digital Definition Update Fix

Technical summary

CVE-2025-7004 is a heap buffer out-of-bounds write (CWE-787) in the PE file scanning engine shared across Gen Digital's antivirus portfolio. The flaw occurs when the parser encounters a malformed Portable Executable file structure and fails to validate buffer boundaries before writing scan results or intermediate analysis data. Exploitation requires user interaction—specifically, the victim must open or allow the antivirus engine to scan the crafted file. Once triggered, the out-of-bounds write can corrupt heap metadata, leading to process termination (denial of service) or potentially enabling code execution if an attacker carefully crafts the payload to overwrite function pointers or other executable heap structures. The fix is delivered through the shared virus definition update mechanism; all affected products pull definitions from the same stream, so a single update (VPS 25040308 or later) mitigates the issue across all consumers.

Business impact

This vulnerability represents a risk to endpoint security posture because it can disable the primary antivirus defense at the moment of infection. An attacker could craft a malicious PE file that crashes the antivirus process when scanned, allowing subsequent malware to execute without real-time protection. For organizations relying on Avast, AVG, Norton, Avast One, or Avast Business Antivirus, a successful exploit could result in temporary loss of active threat detection on affected endpoints. The HIGH CVSS score (7.8) reflects the combination of local attack surface, high confidentiality/integrity/availability impact, and the requirement only for user interaction (not elevated privileges). Businesses should prioritize ensuring all antivirus installations receive the latest definition updates without delay.

Affected systems

Vulnerable versions affect Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus running on Windows, macOS, and Linux platforms. All products using virus definition builds earlier than VPS 25040308 are vulnerable. Because the scanning engine is shared across these products and delivered via a common update stream, the blast radius is substantial—any organization or individual using one of these five products with outdated definitions is at risk. The vulnerability does not require administrator privileges to trigger, only user interaction with a malicious file.

Exploitability

Exploitation requires a user to open or scan a crafted malicious PE file, making this a user-interaction dependent attack. An attacker would need to social engineer a user into opening the file (or place it where automated scanning would occur), but no special network access or privilege escalation is needed. The attack surface is moderate because PE file scanning is a routine antivirus function, and many users regularly receive files from untrusted sources. Once a user scans the malformed PE, the antivirus process can crash immediately or execute code within that process context. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, but the attack vector is straightforward enough that proof-of-concept development is feasible.

Remediation

The primary mitigation is to ensure all antivirus installations receive the latest virus definition update, bringing VPS build to 25040308 or higher. For Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus, definitions typically update automatically; administrators should verify that auto-update is enabled and that no systems are pinned to older definition versions. Gen Digital recommends checking the antivirus UI or management console to confirm the current VPS build number. No product patches or version upgrades are required—the fix flows through the definition update channel. Until definitions are updated, organizations should consider restricting user access to untrusted file sources and educating users to avoid opening suspicious PE files.

Patch guidance

Patches are not required at the product level; instead, the remediation is delivered through the virus definition update stream. Verify that your antivirus console or management platform shows VPS build 25040308 or later. For centrally managed deployments (Avast Business, corporate Norton installations), check your management console to confirm all endpoints have received the latest definitions. If your organization uses manual or custom update schedules, force a manual definition update immediately. Gen Digital states that the fix is available across all affected products consuming the shared definition stream, so a single update deployment addresses all vulnerable installations. Test the update on a non-critical endpoint first if your environment has strict change control procedures.

Detection guidance

Monitor antivirus logs and event records for unexpected process crashes or terminations of the antivirus service, which may indicate exploitation attempts. Look for instances where PE file scanning triggered an antivirus process exit with a heap corruption error or access violation. In environments with behavioral analytics or endpoint detection and response (EDR) tools, track for anomalous heap writes or buffer overflows within the antivirus process memory space. Network-based detection is unlikely since the attack is triggered locally during file scanning, but review user access logs to identify who may have opened suspicious PE files. After applying the definition update (VPS 25040308+), such anomalies should cease.

Why prioritize this

This vulnerability merits immediate attention because it directly impacts the antivirus infrastructure protecting your endpoints. The HIGH CVSS score (7.8) reflects the severity of impact; a successful exploit can disable antivirus protection entirely. The large install base across five major consumer and business antivirus products means many organizations are affected. The fix is simple—an automatic definition update—but organizations that have disabled auto-updates or are using managed environments on slower update cycles remain exposed. Prioritize confirming that all systems have received VPS 25040308 or later within 24–48 hours.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is driven by: (1) Local attack vector (AV:L)—no network access required; (2) Low complexity (AC:L)—the malformed PE file does not require specific system conditions; (3) No privileges required (PR:N)—any user can trigger the scan; (4) User interaction required (UI:R)—a user must open or scan the file; (5) Unchanged scope (S:U)—impact is limited to the antivirus process; (6) High confidentiality, integrity, and availability (C:H/I:H/A:H)—successful exploitation can leak antivirus memory, corrupt system state, or crash the process. The score reflects the dual impact of code execution and denial-of-service against a critical security tool.

Frequently asked questions