# CVE-2025-7004: Gen Digital Antivirus heap overflow in Windows PE scanning

Source: https://junglewise.ai/threats/cve-2025-7004-gen-digital-antivirus-heap-overflow-in-windows-pe-scanning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2025-7004 · Severity: high · CVSS 7.8 · Published 2026-06-12

A vulnerability in several popular antivirus products, including Avast, AVG, and Norton, could allow an attacker to execute malicious code or crash the security software. This occurs when the antivirus engine scans a specially crafted Windows executable file. If exploited, an attacker could gain unauthorized control over the system or disable the antivirus protection entirely.

Technologies: [Gen Digital Avast Antivirus](https://junglewise.ai/threats/technologies/avast-antivirus), [Gen Digital Avast Business Antivirus](https://junglewise.ai/threats/technologies/avast-business-antivirus), [Gen Digital Avast One](https://junglewise.ai/threats/technologies/avast-one), [Gen Digital AVG Antivirus](https://junglewise.ai/threats/technologies/avg-antivirus), [Gen Digital Norton Antivirus](https://junglewise.ai/threats/technologies/norton-antivirus). Vendors: [Gen Digital](https://junglewise.ai/threats/vendors/gen-digital).

## Quick answers

**Is CVE-2025-7004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7004 being exploited in the wild.

**How severe is CVE-2025-7004?** High severity, with a CVSS score of 7.8, published 12 June 2026.

**Which products and versions are affected?** Gen Digital Avast Antivirus Virus definition builds before VPS 25040308; Gen Digital Avast Business Antivirus Virus definition builds before VPS 25040308; Gen Digital Avast One Virus definition builds before VPS 25040308; Gen Digital AVG Antivirus Virus definition builds before VPS 25040308; and 1 more.

**Is there a fix for CVE-2025-7004?** A patch was published on 2025-04-03: Estimated patch date based on VPS version string 25040308 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7004 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-7004?** Check whether you run Gen Digital Avast Antivirus, Gen Digital Avast Business Antivirus, Gen Digital Avast One or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based out-of-bounds write vulnerability exists in the Gen Digital scanning engine used across multiple antivirus brands. The flaw is triggered when the engine processes a malformed Windows Portable Executable (PE) file. While the attack vector is local, it requires minimal privileges (PR:N) but does require user interaction (UI:R), such as a user or the system attempting to scan the malicious file. Successful exploitation can lead to arbitrary code execution in the context of the antivirus process or a denial-of-service (DoS) by crashing the scanning service. The vulnerability was addressed via a virus definition update (VPS 25040308) rather than a full software version increment.

## Affected products

- Gen Digital Avast Antivirus Virus definition builds before VPS 25040308
- Gen Digital AVG Antivirus Virus definition builds before VPS 25040308
- Gen Digital Norton Antivirus Virus definition builds before VPS 25040308
- Gen Digital Avast One Virus definition builds before VPS 25040308
- Gen Digital Avast Business Antivirus Virus definition builds before VPS 25040308

## Timeline

- 2026-06-12: advisory: NVD publication date
- 2025-04-03: patched: Estimated patch date based on VPS version string 25040308

## References

- [https://www.gendigital.com/us/en/contact-us/security-advisories/](https://www.gendigital.com/us/en/contact-us/security-advisories/)

## Related threats

- [Gen Digital Antivirus heap out-of-bounds read in ZIP scanning engine](https://junglewise.ai/threats/cve-2025-7011-gen-digital-antivirus-heap-out-of-bounds-read-in-zip-scanning)
- [Gen Digital Antivirus stack overflow in PDF scanning engine](https://junglewise.ai/threats/cve-2025-7010-gen-digital-antivirus-stack-overflow-in-pdf-scanning-engine)
- [Gen Digital Antivirus out-of-bounds read in PE file scanning](https://junglewise.ai/threats/cve-2025-7009-gen-digital-antivirus-out-of-bounds-read-in-pe-file-scanning)
- [Gen Digital Antivirus heap out-of-bounds read in .NET metadata scanning](https://junglewise.ai/threats/cve-2025-7008-gen-digital-antivirus-heap-out-of-bounds-read-in-net-metadata)