CVE-2025-7005: Avast/AVG/Norton Antivirus Denial-of-Service via Malformed PE File

Technical summary

The vulnerability stems from improper handling of recursion in the Windows PE file parsing logic within the shared Gen Digital scanning engine (CWE-674: Uncontrolled Recursion). When the scanner encounters a malformed PE file with deeply nested or circular structures, the recursion protection fails, causing the process to exhaust stack memory or hit recursion depth limits. This results in a denial-of-service condition affecting the antivirus service. The flaw exists in virus definition builds prior to VPS 25031700. Importantly, the vulnerability is not in the antivirus products themselves but in the shared virus definition engine delivered via Gen Digital's update stream, meaning patching flows through definition updates rather than product version upgrades.

Business impact

A successful attack would temporarily disable antivirus protection on affected systems, creating a window of vulnerability to malware infections. For organizations running Avast, AVG, Norton, or other Gen Digital-powered antivirus solutions, an attacker could craft and distribute malformed executables that, when scanned, crash the antivirus daemon. This is particularly concerning in managed security environments where antivirus is a primary control. The automatic nature of definition updates means most deployments should self-heal quickly upon the next update, but organizations with delayed or offline update schedules face extended exposure.

Affected systems

Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux are affected if they are using virus definition builds before VPS 25031700. Any organization or individual using these products from Gen Digital is potentially in scope. Notably, the vulnerability is not confined to a single product line; it flows through a shared scanning engine, so multiple products from different consumer and business lines are vulnerable simultaneously. Systems running definition builds VPS 25031700 or later are not vulnerable, regardless of the host antivirus product.

Exploitability

Exploitation requires user interaction: a victim must encounter and attempt to scan a specially crafted Windows PE file. This makes it a low-probability attack in typical environments but feasible in targeted or watering-hole scenarios. An attacker cannot exploit this remotely or without user involvement. The CVSS score of 5.5 (Medium) reflects the requirement for user action and local access, balanced against the certain impact on system availability once triggered. No public exploit code or proof-of-concept has been widely documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update virus definitions to build VPS 25031700 or later. Most Avast and Gen Digital products pull updates automatically, so this should occur without user intervention within hours of the definition becoming available. Organizations with manual or scheduled update policies should prioritize deploying this definition update. No product version upgrade is required; the fix is purely a definition update. For air-gapped or offline systems, obtain the latest definition files from Gen Digital's update repository and deploy them manually.

Patch guidance

Verify your current virus definition build version in your antivirus product's settings or logs. Most Gen Digital products display this under Virus Definitions or Engine version. Confirm the build is at VPS 25031700 or higher. If automatic updates are enabled and the product has checked for updates since the fix was released (June 2026), you should be protected. If updates are managed centrally, work with your security team to ensure definition deployment to all endpoints. Verify the update has reached all systems in your environment, particularly any that may have been offline or disconnected during the initial rollout period.

Detection guidance

Monitor for antivirus process crashes or restarts (search for 'avast' or relevant product name in Windows Event Viewer under System or Application logs, or syslog on Unix-like systems). Look for unusual file access patterns where suspicious or malformed PE files are being scanned. Check antivirus logs for scan engine exceptions or abnormal terminations. Confirm definition versions across your fleet to identify any systems still running pre-VPS 25031700 builds. Use your endpoint detection and response (EDR) tool or antivirus management console to confirm all systems have updated to the patched definition version.

Why prioritize this

While the CVSS score is Medium (5.5), the impact on a critical security control—the antivirus engine—warrants quick attention. Antivirus availability is foundational to most security postures. The good news is that Gen Digital's automatic update mechanism means most organizations will be protected without manual intervention, and the attack requires user interaction, reducing exposure. Prioritize verification over urgent emergency patching, unless you operate with manual or delayed update schedules.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: (1) Local Attack Vector—exploitation requires the file to be on or accessible to the victim's system; (2) Low Attack Complexity—no special conditions or bypasses needed once a malformed file is processed; (3) No Privileges Required—any user can trigger the scan; (4) User Interaction Required—user must initiate or allow a scan of the malformed file; (5) High Availability Impact—the antivirus process crashes, temporarily removing protection; (6) No Confidentiality or Integrity Impact—no data is disclosed or corrupted. The score appropriately penalizes the availability loss against the mitigating factor of user interaction.

Frequently asked questions