CVE-2025-7006: Avast, AVG, Norton Antivirus Denial-of-Service via Use-After-Free in PE Scanning

Technical summary

CVE-2025-7006 is a use-after-free memory safety issue (CWE-590) in the shared Gen Digital virus scanning engine. When the scanner processes a malformed Portable Executable (PE) file, it references stack memory after that memory has been freed, triggering a crash of the antivirus process. The vulnerability resides in the scanning logic distributed via Gen Digital's unified virus definition update stream, which is consumed by multiple consumer and business antivirus products. The issue is platform-agnostic and affects Windows, macOS, and Linux builds. Remediation is delivered through the standard virus definition update mechanism; any installation running VPS definition version 25022500 or later is protected.

Business impact

A successful exploit causes temporary unavailability of antivirus protection on affected endpoints. In environments relying on always-on threat detection, this creates a window of vulnerability during which malware can execute without antivirus intervention. Organizations with centralized endpoint detection and response (EDR) or secondary security controls may mitigate the risk; however, smaller deployments or those using antivirus as a primary defense are more exposed. Recovery typically requires manual process restart or system reboot, introducing operational disruption and requiring incident response overhead.

Affected systems

This vulnerability affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux platforms. All installations are vulnerable if they use virus definition builds prior to VPS 25022500. Because the scanning engine is shared across Gen Digital's product portfolio, other embedded Gen Digital scanning engines may also be affected; verify your specific product deployments against Gen Digital's advisory.

Exploitability

Exploitation requires user interaction—specifically, the user or an automated process must initiate a scan on a system containing a malformed PE file. This could occur through drive-by download, USB insertion, network share access, or email attachment scanning. The attack surface is broad because PE files are ubiquitous in Windows environments and antivirus products are designed to scan files automatically. No special privileges are required; a local user can trigger a scan on files in shared directories. However, the attack is limited to denial-of-service and does not provide code execution or privilege escalation, reducing the urgency for attackers seeking persistent access.

Remediation

The primary remediation is updating virus definition builds to VPS 25022500 or later. This update flows through the standard virus definition update channel and does not require product version upgrades. Organizations should verify that automatic definition updates are enabled and confirm that deployed systems have refreshed their definitions within the last 24 hours. Check the antivirus product console or logs for the current VPS build number. No configuration changes or product reinstalls are necessary.

Patch guidance

Update virus definition builds to VPS 25022500 or later via your antivirus product's built-in update mechanism or your organization's update management platform. For Avast, AVG, and Norton consumer products, enable automatic updates in settings to ensure continuous protection. For Avast Business Antivirus and other enterprise deployments, use your management console to push the updated definitions to all endpoints. Verify deployment by checking reported VPS build numbers in endpoint reports or console dashboards. Test in a non-critical environment if your organization requires change control; however, antivirus definition updates are typically low-risk and can be deployed immediately to production.

Detection guidance

Monitor antivirus process crashes or service restarts on endpoints running affected versions. Look for event log entries indicating antivirus service termination or restart, particularly if correlated with file scanning activities. Query your centralized antivirus management console for endpoints still running VPS definitions older than 25022500. If you maintain EDR or SIEM infrastructure, alert on unexpected termination of antivirus service processes or repeated restart cycles. Scan your organization's files and network shares for malformed PE files using forensic tools, though crafted proof-of-concept samples may be limited in availability.

Why prioritize this

Although the CVSS score is moderate (5.5), the attack surface is broad—any user can trigger the vulnerability via file scanning—and antivirus is a critical control in most environments. Even temporary loss of protection introduces significant residual risk, especially in organizations without compensating EDR or threat hunting capabilities. Prioritize patching based on your organization's reliance on antivirus as a primary defense and the presence of secondary security controls. Remote work environments with limited IT oversight should be patched urgently.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, no privilege requirement, and user interaction required. The impact is limited to availability (denial-of-service) with no confidentiality or integrity compromise. However, the score does not account for the downstream business risk of undefended endpoints or the broad attack surface in multi-user and network-attached file scenarios. Organizations should supplement the CVSS rating with their own risk assessment, considering their security posture, asset criticality, and regulatory obligations.

Frequently asked questions