Is CVE-2025-7005 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7005 being exploited in the wild.

How severe is CVE-2025-7005?

Medium severity, with a CVSS score of 5.5, published 12 June 2026.

Which products and versions are affected?

Avast Business Antivirus VPS builds before 25031700; Avast One VPS builds before 25031700.

Is there a fix for CVE-2025-7005?

A patch was published on 2025-03-17: Date inferred from VPS version string 25031700 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-7005 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-7005?

Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7005: Gen Digital Antivirus uncontrolled recursion in PE file scanning

CVE-2025-7005 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability in several popular antivirus products, including Norton, Avast, and AVG, could allow an attacker to crash the antivirus software. By tricking the system into scanning a specially crafted Windows file, the antivirus engine enters an infinite loop that exhausts system resources. This results in a denial-of-service, leaving the computer unprotected against other threats until the service is restored.

Technologies: Avast Business Antivirus, Avast One. Vendors: Avast.

Quick answers

Is CVE-2025-7005 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7005 being exploited in the wild.
How severe is CVE-2025-7005?: Medium severity, with a CVSS score of 5.5, published 12 June 2026.
Which products and versions are affected?: Avast Business Antivirus VPS builds before 25031700; Avast One VPS builds before 25031700.
Is there a fix for CVE-2025-7005?: A patch was published on 2025-03-17: Date inferred from VPS version string 25031700 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7005 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-7005?: Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled recursion vulnerability (CWE-674) exists in the scanning logic of the Gen Digital antivirus engine. The flaw is triggered when the engine attempts to parse a malformed Windows Portable Executable (PE) file. An attacker can exploit this by providing a crafted file that causes the scanning process to exhaust its stack or resources through recursive calls, leading to a crash of the antivirus service (Denial-of-Service). The vulnerability is platform-independent, affecting Windows, macOS, and Linux installations. It has been mitigated via a virus definition (VPS) update; all products using VPS build 25031700 or later are protected.

Affected products

Gen Digital Avast Antivirus VPS builds before 25031700
Gen Digital AVG Antivirus VPS builds before 25031700
Gen Digital Norton Antivirus VPS builds before 25031700
Gen Digital Avast One VPS builds before 25031700
Gen Digital Avast Business Antivirus VPS builds before 25031700

Timeline

2026-06-12: disclosed
2026-06-12: advisory
2025-03-17: patched: Date inferred from VPS version string 25031700

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.