CVE-2025-7009: Heap Buffer Overflow in Avast, AVG, Norton Antivirus – Patch Now

Technical summary

CVE-2025-7009 is a CWE-125 (out-of-bounds read) in the PE file scanning logic shared across multiple Gen Digital antivirus products. The vulnerability manifests when the engine processes a malformed Portable Executable (PE) file header or structure, causing the scanner to read beyond heap buffer boundaries. This memory safety violation can trigger arbitrary code execution in the context of the scanning process or a denial-of-service crash. The affected code is delivered via Gen Digital's centralized virus definition update stream (VPS), meaning the fix applies uniformly across Avast, AVG, Norton, and other products that consume this engine without requiring product-specific patching.

Business impact

Antivirus solutions are critical trust boundaries in endpoint defense. A vulnerability in the scanner itself can undermine the entire security posture of an organization, especially if the antivirus process runs with elevated privileges (common in enterprise deployments). Exploitation could allow malware or a local attacker to disable antivirus protection, introduce code execution within trusted security software, or trigger system instability through repeated denial-of-service attacks during routine scanning operations.

Affected systems

The vulnerability affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux platforms. The shared Gen Digital scanning engine means other products from the vendor's portfolio that embed this engine may also be affected. Any installation using virus definition builds earlier than VPS 25021310 is vulnerable; the update is delivered automatically through Gen Digital's centralized definition update stream.

Exploitability

Exploitation requires local access (AV:L) and user interaction—specifically, the victim must scan a malformed PE file, either through direct user action or automated scanning policies. There is no network vector and no privilege escalation requirement to trigger the vulnerability itself, though the impact (code execution or DoS) depends on the permissions of the antivirus process. The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local access with significant confidentiality, integrity, and availability impact. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

The primary remediation is to ensure virus definition updates are current. Users and administrators should verify that their antivirus installations are running VPS 25021310 or later. Because updates flow through Gen Digital's centralized stream, most modern installations will receive the patch automatically if update checks are enabled. Organizations should confirm that automatic definition updates are not disabled or delayed by policy, and verify the current VPS build in their antivirus console or logs.

Patch guidance

No product version upgrades are required. The fix is delivered via the virus definition stream (VPS 25021310 and later). Verify the current VPS build in your antivirus product: Avast and AVG products typically display this in Settings > General > About or via command-line tools. Norton and other Gen Digital products have equivalent version checks in their console. Enable automatic virus definition updates if not already enabled, and confirm that definition updates are not blocked by firewall or proxy policies. If manual updates are required, initiate a definition update check immediately. Test scanning of suspicious files after updating to ensure normal operation.

Detection guidance

Monitor for signs of antivirus process crashes, restarts, or hangs coinciding with specific file scans (check antivirus logs and Windows Event Viewer for unexpected terminations). Look for audit trails showing the antivirus service stopping or restarting unexpectedly, which may indicate DoS exploitation. If code execution occurs, endpoint detection and response (EDR) tools should flag suspicious child processes spawned from antivirus service processes. Verify VPS build numbers in inventory scans to identify systems still running outdated definitions. Check antivirus logs for scan failures or errors when processing PE files, which may indicate triggering of the vulnerability.

Why prioritize this

While the vulnerability requires local access and user interaction, the fact that it affects antivirus engines—which run with high privilege and trust—makes it a significant priority. A successful exploit could completely bypass endpoint security controls. The widespread nature of Gen Digital's products means many organizations are potentially affected. The CVSS 7.8 score and the availability of an automatic patch mechanism should motivate rapid verification and remediation across all endpoints.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Local Attack Vector (AV:L) because the attacker or user must interact with a file on the system; Low Attack Complexity (AC:L) because no special configuration or race conditions are needed; No Privilege escalation required (PR:N); User Interaction (UI:R) because a file must be scanned; and High impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H) because the antivirus process has broad access to system memory and can execute code or be forcibly stopped.

Frequently asked questions