Is CVE-2025-10101 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10101 being exploited in the wild.

How severe is CVE-2025-10101?

High severity, with a CVSS score of 7.8, published 1 December 2025.

Which products and versions are affected?

Avast Business Antivirus virus definition builds before VPS 25090300; Avast One virus definition builds before VPS 25090300.

Is there a fix for CVE-2025-10101?

A patch was published on 2025-09-03: Fix released in virus definition build VPS 25090300 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-10101 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-10101?

Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10101: Gen Digital Antivirus heap out-of-bounds read in Mach-O scanning

CVE-2025-10101 · Severity: high · CVSS 7.8 · Published 2025-12-01

A vulnerability exists in several popular antivirus products, including Avast, AVG, and Norton, which are used to protect computers from malware. If a user attempts to scan a specially crafted file, the antivirus software may crash or allow an attacker to run unauthorized code on the system. This could lead to a complete system compromise or a loss of security protection.

Technologies: Avast Business Antivirus, Avast One. Vendors: Avast.

Quick answers

Is CVE-2025-10101 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10101 being exploited in the wild.
How severe is CVE-2025-10101?: High severity, with a CVSS score of 7.8, published 1 December 2025.
Which products and versions are affected?: Avast Business Antivirus virus definition builds before VPS 25090300; Avast One virus definition builds before VPS 25090300.
Is there a fix for CVE-2025-10101?: A patch was published on 2025-09-03: Fix released in virus definition build VPS 25090300 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-10101 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-10101?: Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer out-of-bounds read vulnerability (CWE-125) exists in the shared scanning logic used by Avast, AVG, and Norton antivirus products. The flaw is triggered when the engine parses a malformed Mach-O file, a common executable format. An attacker can exploit this by providing a crafted file for scanning, potentially achieving local code execution or causing the antivirus process to crash (Denial of Service). The vulnerability is present in the virus definition update stream and affects Windows, macOS, and Linux installations. A fix has been deployed via the shared update channel; systems running virus definition build VPS 25090300 or later are protected.

Affected products

Gen Digital Avast Antivirus virus definition builds before VPS 25090300
Gen Digital AVG Antivirus virus definition builds before VPS 25090300
Gen Digital Norton Antivirus virus definition builds before VPS 25090300
Gen Digital Avast One virus definition builds before VPS 25090300
Gen Digital Avast Business Antivirus virus definition builds before VPS 25090300

Timeline

2025-12-01: advisory: Initial publication of the advisory
2025-09-03: patched: Fix released in virus definition build VPS 25090300

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.