Is CVE-2025-7006 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7006 being exploited in the wild.

How severe is CVE-2025-7006?

Medium severity, with a CVSS score of 5.5, published 12 June 2026.

Which products and versions are affected?

Avast Business Antivirus Virus definition builds before VPS 25022500; Avast One Virus definition builds before VPS 25022500.

Is there a fix for CVE-2025-7006?

A patch was published on 2025-02-25: Date inferred from VPS version string 25022500 (Feb 25, 2025) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-7006 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-7006?

Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7006: Gen Digital Antivirus stack memory after free in PE scanning engine

CVE-2025-7006 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability exists in several popular antivirus products, including Avast, AVG, and Norton, which are used to protect computers from malware. If a user attempts to scan a specially crafted, malicious file, the antivirus software may crash and stop functioning. This results in a denial-of-service, leaving the system temporarily unprotected until the antivirus process is restarted.

Technologies: Avast Business Antivirus, Avast One. Vendors: Avast.

Quick answers

Is CVE-2025-7006 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7006 being exploited in the wild.
How severe is CVE-2025-7006?: Medium severity, with a CVSS score of 5.5, published 12 June 2026.
Which products and versions are affected?: Avast Business Antivirus Virus definition builds before VPS 25022500; Avast One Virus definition builds before VPS 25022500.
Is there a fix for CVE-2025-7006?: A patch was published on 2025-02-25: Date inferred from VPS version string 25022500 (Feb 25, 2025) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7006 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-7006?: Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'Free of Memory not on the Heap' (CWE-590) vulnerability exists in the shared scanning logic used by Avast, AVG, and Norton antivirus products. The flaw is triggered when the engine attempts to scan a malformed Windows Portable Executable (PE) file, leading to a use-after-free condition involving stack memory. An attacker can exploit this by providing a crafted file to be scanned, causing the antivirus process to crash (Denial-of-Service). The vulnerability is local in nature but requires user interaction (e.g., downloading or opening a folder containing the file). The issue is resolved in virus definition builds VPS 25022500 and later.

Affected products

Gen Digital (Avast) Avast Antivirus Virus definition builds before VPS 25022500
Gen Digital (AVG) AVG Antivirus Virus definition builds before VPS 25022500
Gen Digital (Norton) Norton Antivirus Virus definition builds before VPS 25022500
Gen Digital (Avast) Avast One Virus definition builds before VPS 25022500
Gen Digital (Avast) Avast Business Antivirus Virus definition builds before VPS 25022500

Timeline

2026-06-12: disclosed
2025-02-25: patched: Date inferred from VPS version string 25022500 (Feb 25, 2025)

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.