CVE-2025-7019: Avast Norton AVG Antivirus Stack Overflow DoS (Definition Update Required)

Technical summary

CVE-2025-7019 is a stack buffer overflow (CWE-121) in the Office Open XML file parsing logic used by multiple Gen Digital antivirus engines. The vulnerability exists in the scanning and decompression routines that process malformed OOXML structures. When the parser encounters specific malformed constructs, it writes data beyond the allocated stack buffer, causing a denial-of-service condition that crashes the scanning process. Because the vulnerable code is embedded in Gen Digital's shared virus definition stream (VPS), the fix is delivered centrally rather than as individual product patches; all products consuming definitions at VPS 25020100 and later are no longer vulnerable.

Business impact

When the antivirus process crashes due to this vulnerability, the machine loses active malware scanning protection until the process is restarted or the scan times out. An attacker could weaponize a malformed OOXML file to trigger the crash at a strategically important moment, such as during a broader attack campaign or data exfiltration attempt. For organizations relying on these antivirus products for endpoint protection, unplanned denial-of-service of the scanning engine reduces defense-in-depth posture and could allow malware to slip through undetected. This is particularly concerning in zero-trust architectures where antivirus is a critical control point.

Affected systems

Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus are affected across Windows, macOS, and Linux platforms. Any installation running virus definition builds before VPS 25020100 is vulnerable. Because these products share the same Gen Digital scanning engine and definition stream, other Gen Digital products that embed the same engine may also be affected; check your antivirus vendor advisory for the complete list specific to your deployment.

Exploitability

Exploitation requires user interaction: a victim must open or access a malformed Office Open XML file that triggers the vulnerable parsing logic during a scan. This could occur through email attachments, shared drives, downloaded documents, or intentional placement on a file server. The malformed file itself is not inherently dangerous to end users; the risk is specific to the antivirus scanning process. The attack surface is moderate—any user who can introduce a file into the scanning path (including inadvertently via email) becomes an exploitation vector. However, weaponizing this reliably requires knowledge of the specific malformation that triggers the stack overflow, and the impact is limited to denial-of-service rather than remote code execution.

Remediation

Update your antivirus virus definitions to build VPS 25020100 or later. This is typically automatic if automatic updates are enabled in your antivirus product settings. Verify your current definition build version in the antivirus product console or settings (usually found under 'About' or 'Settings > Updates'). If manual updates are preferred, trigger a definition update immediately. No product upgrade is required—the fix is delivered through the definition stream. After updating, rescan any archived or quarantined files as a precaution.

Patch guidance

Verify your current virus definition build version in your antivirus product. The build number is visible in the product's main window or settings under 'Virus Definitions' or 'Engine Version.' Ensure automatic updates are enabled (antivirus > Settings > Updates > Enable automatic virus definition updates). If you manage antivirus centrally via policy (Avast Business, Norton networks), ensure that definition update policies are set to retrieve the latest VPS definitions automatically. No manual product installation or upgrade is needed. Test in a non-production environment first if you have critical scanning policies in place, though definition updates are universally compatible across all products in the affected family.

Detection guidance

Monitor antivirus application logs for unexpected crashes or restarts of the scanning service. Most antivirus products log scan errors and process terminations; look for entries indicating 'scanning process crashed' or 'stack overflow' in event logs. Endpoint detection and response (EDR) tools can alert on repeated antivirus service restarts, which may indicate the vulnerability being triggered. File integrity monitoring systems may detect the presence of malformed OOXML files staged on your network. Consider deploying content inspection rules in email gateways and web proxies to flag Office Open XML files with known malformation patterns, though this is a heuristic approach and may generate false positives.

Why prioritize this

This vulnerability rates CVSS 5.5 (Medium) because it requires local user interaction, produces only denial-of-service impact, and does not enable privilege escalation or data exfiltration. However, it should be prioritized above the base score suggests because: (1) antivirus is a critical control point, and its denial-of-service directly weakens endpoint security; (2) the fix is trivial (an automated definition update) and carries minimal risk; (3) the attack surface is broad (any user can inadvertently trigger it by opening a malicious document). Organizations should treat this as 'patch immediately' despite the medium score, because the remediation cost is essentially zero and the operational risk of remaining unpatched is high for your security posture.

Risk score, explained

CVSS 5.5 reflects: Attack Vector = Local (the file must be accessed locally), Access Complexity = Low (no special conditions), Privileges Required = None (any user can trigger it), User Interaction = Required (the file must be scanned, typically after user opens it), Scope = Unchanged (impact is limited to the antivirus process), Confidentiality = None, Integrity = None, Availability = High (the scanning service becomes unavailable). This is a moderate severity denial-of-service. The score does not account for the fact that the target is the antivirus engine itself—a security control—which elevates business risk above the numerical score alone.

Frequently asked questions