CVE-2025-7010: Avast Antivirus Stack Overflow DoS Vulnerability – VPS Definition Patch Required

Technical summary

CVE-2025-7010 is a stack overflow vulnerability (CWE-674: Uncontrolled Recursion) affecting the Gen Digital virus definition engine used across Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux platforms. The vulnerability exists in PDF file scanning logic that does not properly validate recursion depth, allowing a malformed PDF to exhaust the stack and crash the scanning engine. Because the vulnerable code is delivered through a shared virus definition update stream (VPS) rather than product-specific binaries, remediation is centralized: all products consuming VPS build 25021208 or later are mitigated, regardless of their individual product versions.

Business impact

Organizations relying on Avast, AVG, or Norton antivirus may experience temporary lapses in malware protection if users open malformed PDFs, particularly if those PDFs are delivered via email or downloads. The denial-of-service is localized to the scanning process and does not compromise system integrity or data confidentiality, but it could allow malicious files to bypass real-time scanning until the antivirus restarts. For enterprises with strict compliance requirements around continuous endpoint protection, repeated crashes could trigger audit findings. The risk is amplified in environments where users frequently receive unsolicited PDFs or where antivirus processes lack automatic recovery mechanisms.

Affected systems

The vulnerability affects the following products on Windows, macOS, and Linux: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. Critically, the vulnerable code is embedded in the shared Gen Digital virus definition engine; mitigation depends on VPS build version, not individual product releases. Any installation of these products with virus definitions older than VPS 25021208 is vulnerable. Other Gen Digital products that embed the same scanning engine may also be affected; administrators should verify their specific product line's status with the vendor.

Exploitability

Exploitation requires local user interaction: an attacker must persuade or trick a user into scanning a malformed PDF file, typically via email attachment, download link, or removable media. The attack surface is broad because PDF is ubiquitous, but it is not remotely exploitable without user action. The CVSS score of 5.5 (Medium) reflects the local attack vector, low complexity, and no privileges required, balanced against limited scope and availability-only impact. This is not an in-the-wild weaponized exploit scenario; it is a denial-of-service condition triggered by malformed file content. Detection in the wild would likely require users to report antivirus crashes following specific file interactions.

Remediation

The authoritative remediation is updating the virus definition engine to VPS build 25021208 or later. Because this update flows through Gen Digital's centralized update channel, most users with automatic definition updates enabled will receive the patch automatically within hours or days of release. Manual remediation involves checking the current VPS build version in the affected product's settings and manually triggering a virus definition update if automatic updates are disabled. Administrators managing multiple endpoints should verify VPS build numbers across their fleet and ensure update policies are enforced. No product reinstallation or rollback is necessary.

Patch guidance

Verify that your Avast, AVG, Norton, Avast One, or Avast Business Antivirus installation has received virus definition updates at or above VPS build 25021208. In most products, this can be confirmed in Settings > Update or similar menu. Enable automatic virus definition updates if they are not already active, as the patch is delivered through the routine VPS channel. If your organization uses a centralized update server or proxy, confirm that it is configured to download and distribute the latest VPS builds. Test the update deployment on a representative sample of endpoints before assuming fleet-wide compliance. No reboot is required after a VPS update in most cases, but verify product-specific guidance from the vendor.

Detection guidance

Monitor for repeated antivirus process crashes (e.g., avast.exe, avgui.exe, or Norton process terminations) coinciding with PDF file scans. Check antivirus logs for stack overflow or recursion-depth-related error messages. Correlation between user reports of 'antivirus stopped working' and PDF file interactions is a leading indicator. Endpoint Detection and Response (EDR) tools should alert on abnormal antivirus process terminations. Verify VPS build versions across your endpoint fleet via inventory or management console queries to identify systems still running pre-25021208 definitions. Hunt for any malformed PDFs that may have been introduced to your environment via email gateways or file repositories; however, note that this is a high-effort hunt with low probability of detection without prior incident indicators.

Why prioritize this

This vulnerability merits medium-priority patching within normal maintenance windows. It requires user interaction and local access, and the impact is denial-of-service rather than data breach or privilege escalation. However, it affects widely deployed consumer and business antivirus products, meaning many organizations are likely vulnerable. The centralized nature of the fix—delivered via VPS channel—means remediation is straightforward for organizations with functioning update processes. Prioritize over low-severity vulnerabilities but defer behind critical RCE or authentication bypass issues. If your organization has evidence of malformed PDFs in circulation or antivirus crashes correlated with PDF handling, elevate to higher priority.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: Attack Vector Local (antivirus runs on the endpoint and must process user-supplied files), Attack Complexity Low (any malformed PDF can trigger the overflow), Privileges Required None (user context is sufficient), User Interaction Required (user or admin must trigger scanning), Scope Unchanged (only the antivirus process is affected), Confidentiality None, Integrity None, Availability High (antivirus process is denied service). The score appropriately captures a nuisance-level DoS that does not expose data or escalate privileges but does temporarily cripple a critical security control.

Frequently asked questions