# CVE-2025-7005: Gen Digital Antivirus uncontrolled recursion in PE file scanning

Source: https://junglewise.ai/threats/cve-2025-7005-gen-digital-antivirus-uncontrolled-recursion-in-pe-file-scanning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2025-7005 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability in several popular antivirus products, including Norton, Avast, and AVG, could allow an attacker to crash the antivirus software. By tricking the system into scanning a specially crafted Windows file, the antivirus engine enters an infinite loop that exhausts system resources. This results in a denial-of-service, leaving the computer unprotected against other threats until the service is restored.

Technologies: [Avast Business Antivirus](https://junglewise.ai/threats/technologies/business-antivirus), [Avast One](https://junglewise.ai/threats/technologies/one). Vendors: [Avast](https://junglewise.ai/threats/vendors/avast).

## Quick answers

**Is CVE-2025-7005 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7005 being exploited in the wild.

**How severe is CVE-2025-7005?** Medium severity, with a CVSS score of 5.5, published 12 June 2026.

**Which products and versions are affected?** Avast Business Antivirus VPS builds before 25031700; Avast One VPS builds before 25031700.

**Is there a fix for CVE-2025-7005?** A patch was published on 2025-03-17: Date inferred from VPS version string 25031700 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7005 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-7005?** Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled recursion vulnerability (CWE-674) exists in the scanning logic of the Gen Digital antivirus engine. The flaw is triggered when the engine attempts to parse a malformed Windows Portable Executable (PE) file. An attacker can exploit this by providing a crafted file that causes the scanning process to exhaust its stack or resources through recursive calls, leading to a crash of the antivirus service (Denial-of-Service). The vulnerability is platform-independent, affecting Windows, macOS, and Linux installations. It has been mitigated via a virus definition (VPS) update; all products using VPS build 25031700 or later are protected.

## Affected products

- Gen Digital Avast Antivirus VPS builds before 25031700
- Gen Digital AVG Antivirus VPS builds before 25031700
- Gen Digital Norton Antivirus VPS builds before 25031700
- Gen Digital Avast One VPS builds before 25031700
- Gen Digital Avast Business Antivirus VPS builds before 25031700

## Timeline

- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2025-03-17: patched: Date inferred from VPS version string 25031700

## References

- [https://www.gendigital.com/us/en/contact-us/security-advisories/](https://www.gendigital.com/us/en/contact-us/security-advisories/)

## Related threats

- [Gen Digital Antivirus stack overflow in Office Open XML scanning](https://junglewise.ai/threats/cve-2025-7019-gen-digital-antivirus-stack-overflow-in-office-open-xml-scanning)
- [Gen Digital Antivirus stack memory after free in PE scanning engine](https://junglewise.ai/threats/cve-2025-7006-gen-digital-antivirus-stack-memory-after-free-in-pe-scanning)
- [Gen Digital Antivirus heap out-of-bounds read in Mach-O scanning](https://junglewise.ai/threats/cve-2025-10101-gen-digital-antivirus-heap-out-of-bounds-read-in-mach-o-scanning)