CVE-2025-7011: Avast, AVG, Norton Antivirus Heap Overflow in Zip Scanning

Technical summary

CVE-2025-7011 is a heap out-of-bounds read (CWE-125) in the file scanning logic of Gen Digital's shared antivirus engine. When processing malformed zip files with embedded XML, the scanner fails to properly validate buffer boundaries during heap memory access. This occurs in virus definition builds 25020100 through 25021207. The vulnerability manifests in the scanning process itself, making it exploitable through user interaction with crafted files. The shared engine architecture means the vulnerability and its fix propagate uniformly across Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus products on supported operating systems.

Business impact

Organizations relying on these antivirus products face two primary risks: denial-of-service of endpoint protection during active malware scanning operations, and potential local code execution with the privileges of the antivirus service (often SYSTEM-level on Windows). The widespread deployment of Gen Digital's engine means the vulnerability affects a large installed base. The impact is heightened because antivirus processes are security-critical; their compromise undermines the entire endpoint defense posture. Supply-chain risk is notable—attackers need only distribute a malformed zip file (via email, web downloads, or file shares) to trigger the vulnerability on unpatched endpoints.

Affected systems

Five antivirus product families are affected: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus. Vulnerable versions span Windows, macOS, and Linux platforms. All installations using Gen Digital virus definition builds 25020100 through 25021207 are in scope. Organizations running build 25021208 or later are not vulnerable. The shared engine means that other Gen Digital-branded products using the same scanning logic may also be affected; verify your product's definition build status against Gen Digital's advisory.

Exploitability

Exploitation requires local access and user interaction. An attacker must place a malformed zip file on a system where it will be scanned by the vulnerable antivirus. This is a relatively low bar—email attachments, downloaded files, or shared network folders trigger automatic scanning on most installations. No authentication is required, and the attack works across supported platforms. The out-of-bounds read condition is deterministic if the malformed XML triggers the exact parsing path; however, practical exploitation to achieve code execution rather than denial-of-service depends on heap layout and memory protection mechanisms (ASLR, DEP). Proof-of-concept zip files demonstrating the DoS condition are likely to emerge quickly.

Remediation

Update virus definitions to build 25021208 or later. This definition update is delivered through the standard Gen Digital update channel and should deploy automatically if automatic updates are enabled. Manual updates can be forced through each product's settings. No product version updates are required—the fix flows through the definition stream. Organizations should verify their current definition build number and ensure update policies are not blocking this critical patch. Test the update in a non-production environment first if your environment includes custom scanning policies or integration with third-party security tools.

Patch guidance

Verify your current virus definition build number in the antivirus application's settings or About section. Confirm it is 25021208 or later. If below this build, initiate a manual update check (most products offer this via Settings > Update or a similar menu). For organizations with centralized management (Avast Business, corporate Norton deployments), verify that definition push policies are active and that no network-level blocks are preventing definition downloads. Test updates on a sample of endpoints before broad rollout to ensure no compatibility issues with your security infrastructure. No rollback concerns are documented; older definitions are simply less effective at threat detection.

Detection guidance

Monitor antivirus process crashes or restarts correlated with scanning events. Check antivirus logs for heap exceptions or access violations during file scanning, especially when processing zip files. In Windows Event Viewer, look for application errors from the antivirus executable with exception codes related to memory access violations (0xC0000374 for heap corruption, 0xC0000005 for access violation). On Linux/macOS, check syslog or the antivirus daemon logs for segmentation faults or abort signals during scanning. If you observe antivirus crashes after users access certain files, isolate those files and report them to Gen Digital's threat intelligence team. Implement file scanning in a sandboxed or isolated environment if investigating suspicious zip files.

Why prioritize this

This vulnerability merits high priority despite not being on the KEV catalog. It affects foundational endpoint security infrastructure across a broad installed base, combines achievable exploitation (user interaction with crafted files) with severe impact (antivirus compromise), and is actively being patched across multiple major security vendors. The heap out-of-bounds read is a classic memory safety issue with a well-understood attack surface. The definition-based delivery mechanism means remediation is simple but requires proactive verification. Organizations should prioritize confirmation of patch deployment within 2–4 weeks to avoid prolonged exposure.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (requires system access), low attack complexity (file-based trigger), no privilege requirement, user interaction (file scanning), and high impact across confidentiality, integrity, and availability. The score appropriately captures the memory corruption risk and potential for both DoS and code execution. It does not weight the prevalence of antivirus deployment or the supply-chain nature of the vulnerability; those factors argue for treating this as a top-tier priority despite the numeric score.

Frequently asked questions